JESD220B

JEDEC
STANDARD
Universal Flash Storage (UFS)
Version 2.0
JESD220B
(Revision of JESD220A, June 2012)
SEPTEMBER 2013
JEDEC SOLID STATE TECHNOLOGY ASSOCIATION

NOTICE
JEDEC standards and publications contain material that has been prepared, reviewed, and
approved through the JEDEC Board of Directors level and subsequently reviewed and approved
by the JEDEC legal counsel.
JEDEC standards and publications are designed to serve the public interest through eliminating
misunderstandings between manufacturers and purchasers, facilitating interchangeability and
improvement of products, and assisting the purchaser in selecting and obtaining with minimum
delay the proper product for use by those other than JEDEC members, whether the standard is to
be used either domestically or internationally.
JEDEC standards and publications are adopted without regard to whether or not their adoption
may involve patents or articles, materials, or processes. By such action JEDEC does not assume
any liability to any patent owner, nor does it assume any obligation whatever to parties adopting
the JEDEC standards or publications.
The information included in JEDEC standards and publications represents a sound approach to
product specification and application, principally from the solid state device manufacturer
viewpoint. Within the JEDEC organization there are procedures whereby a JEDEC standard or
publication may be further processed and ultimately become an ANSI standard.
No claims to be in conformance with this standard may be made unless all requirements stated in
the standard are met.
Inquiries, comments, and suggestions relative to the content of this JEDEC standard or
publication should be addressed to JEDEC at the address below, or refer to www.jedec.org under
Standards and Documents for alternative contact information.
Published by
©JEDEC Solid State Technology Association 2013
3103 North 10th Street
Suite 240 South
Arlington, VA 22201-2107
This document may be downloaded free of charge; however JEDEC retains the
copyright on this material. By downloading this file the individual agrees not to
charge for or resell the resulting material.
PRICE: Contact JEDEC
Printed in the U.S.A.

All rights reserved
PLEASE!
DON’T VIOLATE
THE
LAW!
This document is copyrighted by JEDEC and may not be

reproduced without permission.
For information, contact:
JEDEC Solid State Technology Association

3103 North 10th Street
Suite 240 South
or refer to www.jedec.org under Standards-Documents/Copyright Information.

JEDEC Standard No. 220B
UNIVERSAL FLASH STORAGE (UFS), VERSION 2.0
CONTENTS
Page
1 Scope 1
2 Normative Reference 1
3 Terms and Definitions 2
4 Introduction 7
4.1 General Features 7
4.2 Interface Features 8
4.3 Functional Features 8
5 UFS Architecture Overview 9
5.1 UFS Top level Architecture 9
5.2 UFS System Model 12
5.3 System Boot and Enumeration 12
5.4 UFS Interconnect (UIC) Layer 13
5.4.1 UFS Physical Layer Signals 13
5.4.2 MIPI UniPro 13
5.4.3 MIPI UniPro Related Attributes 14
5.5 UFS Transport Protocol (UTP) Layer 14
5.5.1 Architectural Model 15
5.6 UFS Application and Command Layer 19
6 UFS Electrical: Clock, Reset, Signals and Supplies 20
6.1 Embedded UFS Signals 20
6.2 UFS Memory Card Signals 21
6.3 Reset Signal 22
6.4 Power Supplies 22
6.5 Reference Clock 23
6.5.1 HS Gear Rates 24
6.5.2 Host Controller requirements for reference clock generation 25
6.6 External Charge Pump Capacitors (Optional) 26
6.7 Absolute Maximum DC Ratings 27
7 Reset, Power-up and Power-down 28
7.1 Reset 28
7.1.1 Power-on Reset 28
7.1.2 Hardware Reset 29
7.1.3 EndPointReset 30
7.1.4 Logical Unit Reset 31
7.1.5 Other Resets 31
7.1.6 Summary of Resets and Device Behavior 32
7.2 Power up ramp 33
-i-
7.3 Power off ramp 34

7.4 UFS Device Power Modes and LU Power Condition 35
7.4.1 Device Power Modes 35
7.4.2 Power Management Command: START STOP UNIT 43
7.4.3 Power Mode Control 45
7.4.4 Logical Unit Power Condition 47
8 UFS UIC Layer: MIPI M-PHY 48
8.1 Termination 48
8.2 Drive Levels 48
8.3 PHY State machine 48
8.4 HS Burst 49
8.4.1 HS Prepare Length Control 49
8.4.2 HS Sync Length Control 49
8.4.3 Slew Rate Control 49
8.5 PWM Burst 49
8.5.1 LS Prepare Length Control 49
8.6 UFS PHY Attributes 49
8.7 Operation Timings 52
8.7.1 Reference Clock Timings 52
8.8 Electrical characteristics 52
8.8.1 Transmitter Characteristics 52
8.8.2 Receiver Characteristics 52
9 UFS UIC Layer: MIPI Unipro 53
9.1 Overview 53
9.2 Architectural Model 53
9.3 UniPro/UFS Transport Protocol Interface (Data Plane) 54
9.4 UniPro/UFS Control Interface (Control Plane) 55
9.5 UniPro/UFS Transport Protocol Address Mapping 56
9.6 Options and Tunable Parameters of UniPro 57
9.6.1 UniPro PHY Adapter 57
9.6.2 UniPro Data Link Layer 57
9.6.3 UniPro Network Layer 57
9.6.4 UniPro Transport Layer 57
9.6.5 UniPro Device Management Entity Transport Layer 58
9.6.6 UniPro Attributes 59
10 UFS Transport Protocol (UTP) Layer 60
10.1 Overview 60
10.2 UTP and UniPro Specific Overview 61
10.2.1 Phases 61
10.2.2 Data Pacing 61
10.2.3 UniPro 61
10.3 UFS Transport Protocol Transactions 62
10.3.1 Overview 62
10.4 Service Delivery Subsystem 62
-ii-
10.4.1 UPIU Transaction Codes 62

10.5 General UFS Protocol Information Unit Format 64
10.5.1 Overview 65
10.5.2 Basic Header Format 65
10.5.3 COMMAND UPIU 70
10.5.4 RESPONSE UPIU 73
10.5.5 DATA OUT UPIU 81
10.5.6 DATA IN UPIU 83
10.5.7 READY TO TRANSFER UPIU 85
10.5.8 TASK MANAGEMENT REQUEST UPIU 87
10.5.9 TASK MANAGEMENT RESPONSE UPIU 89
10.5.10 QUERY REQUEST UPIU 91
10.5.11 QUERY RESPONSE UPIU 104
10.5.12 REJECT UPIU 116
10.5.13 NOP OUT UPIU 118
10.5.14 NOP IN UPIU 120
10.6 Logical Units 122
10.6.1 Overview 122
10.6.2 UFS SCSI Domain 122
10.6.3 UFS Logical Unit Definition 122
10.6.4 Well-Known Logical Unit Definition 123
10.6.5 Logical Unit Addressing 123
10.6.6 Well Known Logical Unit Defined in UFS 124
10.6.7 Translation of 8-bit UFS LUN to 64-bit SCSI LUN Address 125
10.6.8 SCSI Write Command 126
10.6.9 SCSI Read Command 127
10.7 Application Layer and Device Manager Transport Protocol Services 128
10.7.1 UFS Initiator Port and Target Port Attributes 128
10.7.2 Execute Command procedure call transport protocol services 128
10.7.3 Send SCSI Command transport protocol service 130
10.7.4 SCSI Command Received transport protocol 131
10.7.5 Send Command Complete transport protocol service 132
10.7.6 Command Complete Received transport protocol service 133
10.7.7 Data transfer SCSI transport protocol services 133
10.7.8 Task Management Function procedure calls 140
10.7.9 Query Function transport protocol services 145
11 UFS Protocol layer – SCSI Commands 149
11.1 Universal Flash Storage Command Layer (UCL) Introduction 149
11.1.1 The Command Descriptor Block (CDB) 149
11.2 Universal Flash Storage Native Commands (UNC) 149
11.3 Universal Flash Storage SCSI Commands 150
11.3.1 General information about SCSI commands in UFS 151
11.3.2 INQUIRY Command 151
11.3.3 MODE SELECT (10) Command 154
-iii-
11.3.4 MODE SENSE (10) Command 156

11.3.5 READ (6) Command 159
11.3.6 READ (10) Command 160
11.3.7 READ (16) Command 162
11.3.8 READ CAPACITY (10) Command 164
11.3.9 READ CAPACITY (16) Command 166
11.3.10 START STOP UNIT 170
11.3.11 TEST UNIT READY Command 171
11.3.12 REPORT LUNS Command 172
11.3.13 VERIFY (10) 177
11.3.14 WRITE (6) Command 179
11.3.17 REQUEST SENSE Command 187
11.3.18 FORMAT UNIT Command 191
11.3.19 PRE-FETCH (10) Command 193
11.3.20 PRE-FETCH (16) Command 196
11.3.21 SECURITY PROTOCOL IN Command 197
11.3.22 SECURITY PROTOCOL OUT Command 199
11.3.23 SEND DIAGNOSTIC Command 201
11.3.24 SYNCHRONIZE CACHE (10) Command 203
11.3.25 SYNCHRONIZE CACHE (16) Command 206
11.3.26 UNMAP Command 207
11.3.27 READ BUFFER Command 210
11.3.28 WRITE BUFFER Command 213
11.4 Mode Pages 216
11.4.1 Mode Page Overview 216
11.4.2 UFS Supported Pages 221
12 UFS Security 228
12.1 UFS Security Feature Support Requirements 228
12.2 Secure Mode 228
12.2.1 Description 228
12.2.2 Requirements 229
12.2.3 Implementation 230
12.3 Device Data Protection 235
12.3.1 Description and Requirements 235
12.4 RPMB 236
12.4.1 Description 236
12.4.2 RPMB Well Known Logical Unit Description 236
12.4.3 Requirements 237
12.4.5 SECURITY PROTOCOL IN/OUT Commands 243
12.4.6 RPMB Operations 248
-iv-
12.5 Malware Protection 260

12.6 Mechanical 260
13 UFS FUNCTIONAL DESCRIPTIONS 261
13.1 UFS Boot 261
13.1.1 Introduction 261
13.1.2 Boot Configuration 261
13.1.3 Initialization and boot code download process 264
13.1.4 Initialization process without boot code download 267
13.1.5 Boot Logical Unit Operations 268
13.1.6 Configurability 268
13.1.7 Security 269
13.2 Logical Unit Management 269
13.2.1 Introduction 269
13.2.2 Logical Unit features 269
13.2.3 Logical Unit Configuration 272
13.3 Logical Block Provisioning 275
13.4 Host Device Interaction 276
13.4.1 Overview 276
13.4.2 Applicable Devices 276
13.4.3 Command Queue: Inter-LU Priority 276
13.4.4 Background Operations Mode 277
13.4.5 Power Off Notification 279
13.4.6 Dynamic Device Capacity 280
13.4.7 Data Reliability 284
13.4.8 Real-Time Clock Information 285
13.4.9 Context Management 286
13.4.10 System Data Tag Mechanism 290
13.4.11 Exception Events Mechanism 291
13.4.12 Data transfer rules related with RTT (Ready-to-Transfer) 292
13.5 UFS Cache 297
14 UFS Descriptors, Flags and Attributes 299
14.1 UFS Descriptors 299
14.1.1 Descriptor Types 299
14.1.2 Descriptor Indexing 300
14.1.3 Accessing Descriptors 300
14.1.4 Read Descriptor 301
14.1.5 Write Descriptor 302
14.1.6 Descriptor Page Definitions 303
14.2 Flags 328
14.3 Attributes 333
15 Annex A - Dynamic Capacity Host Implementation Example 342
15.1 Overview 342
15.2 Method Outline 342
-v-
FIGURES
Figure 5.1: UFS Top Level Architecture ...................................................................................................... 9
Figure 5.2: Usage of UDM_SAP ................................................................................................................ 10
Figure 5.3: Usage of UIO_SAP .................................................................................................................. 10
Figure 5.4: UFS System Model .................................................................................................................. 12
Figure 5.5: SCSI Domain Class Diagram ................................................................................................... 16
Figure 5.6: UFS Domain Class Diagram .................................................................................................... 17
Figure 6.1: UFS Device Block Diagram ..................................................................................................... 20
Figure 6.2: Clock input levels, rise time, and fall time ............................................................................... 24
Figure 6.4: Output driver and Input receiver levels .................................................................................... 25
Figure 6.5: Clock output levels, rise time and fall time .............................................................................. 26
Figure 7.1: Power-on Reset........................................................................................................................ 28
Figure 7.2: Hardware Reset ........................................................................................................................ 29
Figure 7.3: Reset AC timings...................................................................................................................... 29
Figure 7.4: EndPointReset .......................................................................................................................... 30
Figure 7.5: Logical Unit Reset .................................................................................................................... 31
Figure 7.6: Power up ramps ........................................................................................................................ 33
Figure 7.7: Power off ramps ....................................................................................................................... 34
Figure 7.8: Power Mode State Machine...................................................................................................... 39
Figure 8.1: Simplified example for I/O termination ................................................................................... 48
Figure 9.1: UniPro internal layering view (left) and UniPro Black Box view (right) ................................ 53
Figure 10.1: UFS SCSI domain ................................................................................................................ 122
Figure 10.2: Logical Unit Addressing....................................................................................................... 123
Figure 10.3: SCSI Write ........................................................................................................................... 126
Figure 10.4: SCSI Read ............................................................................................................................ 127
Figure 10.5: Command w/o Data Phase.................................................................................................... 129
Figure 10.6: Command + Read Data Phase 1/2 ........................................................................................ 135
Figure 10.7: Command + Read Data Phase 2/2 ........................................................................................ 136
Figure 10.8: Command + Write Data Phase 1/2 ....................................................................................... 138
Figure 10.9: Command + Write Data Phase 2/2 ....................................................................................... 139
Figure 10.10: Task Management Function ............................................................................................... 143
Figure 10.11: UFS Query Function........................................................................................................... 146
Figure 11.1: UFS Command Layer ........................................................................................................... 149
Figure 12.1: Purge operation state machine .............................................................................................. 232
Figure 12.2: Authentication Key Programming Flow............................................................................... 255
Figure 12.3: Read Counter Value Flow .................................................................................................... 256
Figure 12.4: Authenticated Data Write Flow ............................................................................................ 258
Figure 12.5: Authenticated Read Flow ..................................................................................................... 260
Figure 13.1: UFS System Diagram ........................................................................................................... 261
Figure 13.2: Example of UFS Device Memory Organization for Boot ................................................... 263
Figure 13.3: Device Initialization and Boot Procedure Sequence Diagram ............................................. 266
Figure 13.4: Example of UFS Device Memory Organization .................................................................. 270
Figure 13.5: Physical Memory Resource State Machine .......................................................................... 283
-vi-
Figure 13.6: Example of data status after a power failure during reliable write operation ....................... 284
Figure 13.7: Host-Device interaction example for Rule-1 ........................................................................ 292
Figure 13.8: Host-Device interaction example for Data Out Mismatch Error case .................................. 293
Figure 13.9: Host-Device interaction example for Rule-2 ........................................................................ 293
Figure 13.10: Host-Device interaction example for Rule-3 ...................................................................... 294
Figure 13.11: Host-Device interaction for LU with same the priority ...................................................... 295
Figure 13.12: Host-Device interaction for LU with different priorities .................................................... 295
Figure 14.1: Descriptor Organization ....................................................................................................... 300
Figure 14.2: Read Request Descriptor ...................................................................................................... 301
Figure 14.3: Write Request Descriptor ..................................................................................................... 302
TABLES
Table 5.1: UFS Signals ............................................................................................................................... 13

Table 5.2: ManufacturerID and DeviceClass Attributes ............................................................................. 14
Table 6.1: Signal Name and Definitions ..................................................................................................... 21
Table 6.2: Reset Signal Electrical Parameters ............................................................................................ 22
Table 6.3: UFS Supply Voltages................................................................................................................. 22
Table 6.4: Voltage configurations for Embedded UFS ............................................................................... 22
Table 6.5: Voltage configurations for UFS Card ........................................................................................ 22
Table 6.6: Reference Clock parameters ...................................................................................................... 23
Table 6.7: HS-BURST Rates ...................................................................................................................... 24
Table 6.8: Host controller reference clock parameters ............................................................................... 25
Table 6.9: Charge pump capacitors description .......................................................................................... 26
Table 6.10: Charge pump related ball names .............................................................................................. 27
Table 6.11: Absolute maximum DC ratings ............................................................................................... 27
Table 7.1: Reset timing parameters............................................................................................................. 29
Table 7.2: Reset States ................................................................................................................................ 32
Table 7.3: UniPro Attributes and Descriptor Reset .................................................................................... 32
Table 7.4: Allowed SCSI commands and UPIU for each Power Mode ..................................................... 41
Table 7.5: Device Well Known Logical Unit Responses to SSU command .............................................. 42
Table 7.6: Device Well Known Logical Unit Responses to commands other than SSU ............................ 43
Table 7.7: Pollable Sense Data for each Power Modes .............................................................................. 43
Table 7.8: START STOP UNIT command ................................................................................................. 43
Table 7.9: START STOP UNIT fields........................................................................................................ 44
Table 7.10: Attribute for Power Mode Control........................................................................................... 45
Table 7.11: Device Descriptor parameters .................................................................................................. 45
Table 7.12: Power Parameters Descriptor fields ......................................................................................... 46
Table 7.13: Format for Power Parameter element ...................................................................................... 46
Table 7.14: Logical Unit Response to SCSI command............................................................................... 47
Table 8.1: UFS PHY M-TX Capability Attributes ..................................................................................... 50
Table 8.2: UFS PHY M-RX Capability Attributes ..................................................................................... 51
-vii-
Table 9.1: DME Service Primitives ............................................................................................................ 58

Table 9.2: UniPro Attribute ........................................................................................................................ 59
Table 10.1: UPIU Transaction Codes ......................................................................................................... 62
Table 10.2: UPIU Transaction Code Definitions ........................................................................................ 63
Table 10.3: General format of the UFS Protocol Information Unit ............................................................ 64
Table 10.4: Basic Header Format ............................................................................................................... 65
Table 10.5: Transaction Type Format ......................................................................................................... 65
Table 10.6: UPIU Flags .............................................................................................................................. 66
Table 10.7: Task Attribute definition .......................................................................................................... 66
Table 10.8: UTP Response Values ............................................................................................................. 67
Table 10.9: UPIU associated to a single task .............................................................................................. 67
Table 10.10: Command Set Type ............................................................................................................... 68
Table 10.11: COMMAND UPIU ................................................................................................................ 70
Table 10.12: Flags Definition for COMMAND UPIU ............................................................................... 71
Table 10.13: RESPONSE UPIU ................................................................................................................. 73
Table 10.14: SCSI Status Values ................................................................................................................ 75
Table 10.15: Flags and Residual Count Relationship ................................................................................. 77
Table 10.16: SCSI Sense Data Format........................................................................................................ 79
Table 10.17: Sense Key .............................................................................................................................. 80
Table 10.18: DATA OUT UPIU ................................................................................................................. 81
Table 10.19: SCSI Data IN UPIU ............................................................................................................... 83
Table 10.20: READY TO TRANSFER UPIU........................................................................................... 85
Table 10.21: Task Management Request UPIU .......................................................................................... 87
Table 10.22: Task Management Function values ....................................................................................... 88
Table 10.23: Task Management Input Parameters...................................................................................... 88
Table 10.24: Task Management Response UPIU ....................................................................................... 89
Table 10.25: Task Management Output Parameters ................................................................................... 90
Table 10.26: Task Management Service Response..................................................................................... 90
Table 10.27: QUERY REQUEST UPIU .................................................................................................... 91
Table 1028: Query Function field values .................................................................................................... 93
Table 10.29: Transaction specific fields ..................................................................................................... 94
Table 10.30: Query Function opcode values .............................................................................................. 94
Table 10.31: Read descriptor ...................................................................................................................... 95
Table 10.32: Write Descriptor .................................................................................................................... 96
Table 10.33: Read Attribute ........................................................................................................................ 97
Table 10.34: Write Attribute ....................................................................................................................... 98
Table 10.35: Read Flag ............................................................................................................................... 99
Table 10.36: Set Flag ................................................................................................................................ 100
Table 10.37: Clear Flag............................................................................................................................. 101
Table 10.38: Toggle Flag .......................................................................................................................... 102
Table 10.39: NOP ..................................................................................................................................... 103
Table 10.40: QUERY RESPONSE ........................................................................................................... 104
Table 10.41: Query Response Code .......................................................................................................... 105
Table 10.42: Transaction Specific Fields .................................................................................................. 106
-viii-
Table 10.43: Query Function opcode values ............................................................................................ 106

Table 10.44: Read Descriptor ................................................................................................................... 107
Table 10.45: Write Descriptor .................................................................................................................. 108
Table 10.46: Read Attribute Response Data Format ................................................................................ 109
Table 10.47: Write Attribute ..................................................................................................................... 110
Table 10.48: Read Flag Response Data Format ........................................................................................ 111
Table 10.49: Set Flag ................................................................................................................................ 112
Table 10.50: Clear Flag............................................................................................................................. 113
Table 10.51: Toggle Flag .......................................................................................................................... 114
Table 10.52: NOP ..................................................................................................................................... 115
Table 10.53: Reject UPIU ......................................................................................................................... 116
Table 10.54: Basic Header Status Description.......................................................................................... 117
Table 10.55: E2E Status Definition .......................................................................................................... 117
Table 10.56: NOP OUT UPIU .................................................................................................................. 118
Table 10.57: NOP IN UPIU ...................................................................................................................... 120
Table 10.58: Well known logical unit commands .................................................................................... 124
Table 10.59: Examples of logical unit representation format ................................................................... 125
Table 10.60: UFS Initiator Port and Target Port Attributes ...................................................................... 128
Table 10.61: Send SCSI Command transport protocol service................................................................. 130
Table 10.62: SCSI Command Received transport protocol ...................................................................... 131
Table 10.63: Send Command Complete transport protocol service.......................................................... 132
Table 10.64: Command Complete Received transport protocol service ................................................... 133
Table 10.65: Send Data-In transport protocol service .............................................................................. 134
Table 10.66: Data-In Delivered transport protocol service ....................................................................... 134
Table 10.67: Receive Data-Out transport protocol service ....................................................................... 137
Table 10.68: Data-Out Received transport protocol service ..................................................................... 137
Table 10.69: Task Management Function procedure calls ....................................................................... 140
Table 10.70: SCSI transport protocol service responses ........................................................................... 140
Table 10.71: Send Task Management Request SCSI transport protocol service request ......................... 144
Table 10.72: Task Management Request Received SCSI transport protocol service indication .............. 144
Table 10.73: Task Management Function Executed SCSI transport protocol service response ............... 144
Table 10.74: Received Task Management Function Executed SCSI transport protocol service
confirmation .............................................................................................................................................. 145
Table 10.75: Send Query Request UFS transport protocol service .......................................................... 145
Table 10.76: Query Request Received UFS transport protocol service indication ................................... 147
Table 10.77: Query Function Executed UFS transport protocol service response .................................. 147
Table 10.78: Received Query Function Executed UFS transport protocol service confirmation ............. 148
Table 11.1: UFS SCSI Command Set ....................................................................................................... 150
Table 11.2: INQUIRY command .............................................................................................................. 151
Table 11.3: Standard INQUIRY data format ............................................................................................ 152
Table 11.4: Inquiry Response Data ........................................................................................................... 153
Table 11.5: MODE SELECT (10) Command ........................................................................................... 154
Table 11.6: Mode Select Command Parameters ....................................................................................... 155
Table 11.7: MODE SENSE (10) Command ............................................................................................. 157
-ix-
Table 11.8: Mode Sense Command Parameters ...................................................................................... 157

Table 11.9: Page Control Function ........................................................................................................... 158
Table 11.10: READ (6) UFS Command ................................................................................................... 159
Table 11.11: READ (10) UFS Command ................................................................................................. 160
Table 11.12: READ (16) UFS Command ................................................................................................ 162
Table 11.13: READ CAPACITY (10) ...................................................................................................... 164
Table 11.14: Read Capacity (10) Parameter Data ..................................................................................... 165
Table 11.15: READ CAPACITY (16) ...................................................................................................... 166
Table 11.16: Read Capacity (16) Parameter Data ..................................................................................... 168
Table 11.17: START STOP UNIT command ........................................................................................... 170
Table 11.18: TEST UNIT READY command .......................................................................................... 171
Table 11.19: REPORT LUNS command .................................................................................................. 172
Table 11.20: Report LUNS Command Parameters ................................................................................... 173
Table 11.21: Report LUNS Command Select Report Field Values.......................................................... 173
Table 11.22: Report LUNS Parameter Data Format ................................................................................. 174
Table 11.23: Single level LUN structure using peripheral device addressing method ............................. 174
Table 11.24: Well Known Logical Unit Extended Addressing Format .................................................... 175
Table 11.25: Format of LUN field in UPIU.............................................................................................. 176
Table 11.26: Well known logical unit numbers ........................................................................................ 176
Table 11.27: VERIFY Command Descriptor Block ................................................................................. 177
Table 11.28: Verify Command Parameters............................................................................................... 178
Table 11.29: WRITE (6) Command Descriptor Block ............................................................................ 179
Table 11.30: WRITE (10) Command Descriptor Block ........................................................................... 181
Table 11.31: WRITE (16) Command Descriptor Block .......................................................................... 184
Table 11.32: REQUEST SENSE Command Descriptor Block ................................................................ 187
Table 11.33: Sense Data ........................................................................................................................... 188
Table 11.34: Sense Key Descriptions ....................................................................................................... 189
Table 11.35: FORMAT UNIT Command Descriptor Block .................................................................... 191
Table 11.36: Format Unit Command Parameters ..................................................................................... 191
Table 11.37: PRE_FETCH Command Descriptor Block ......................................................................... 193
Table 11-.38: PRE-FETCH Command Parameters .................................................................................. 194
Table 11.39: PRE-FETCH (16) Command Descriptor Block .................................................................. 196
Table 11.40: SECURITY PROTOCOL IN command .............................................................................. 197
Table 11.41: SECURITY PROTOCOL OUT command .......................................................................... 199
Table 11.42: SEND DIAGNOSTIC Command Descriptor Block............................................................ 201
Table 11.43: Send Diagnostic Parameters ................................................................................................ 201
Table 11.44: SYNCHRONIZE CACHE Command Descriptor Block ..................................................... 203
Table 11.45: Synchronize Cache Command Parameters .......................................................................... 204
Table 11.46: SYNCHRONIZE CACHE (16) Command Descriptor Block ............................................. 206
Table 11.47: UNMAP Command Descriptor Block ................................................................................. 207
Table 11.48: UNMAP parameter list ........................................................................................................ 208
Table 11.49: UNMAP block descriptor .................................................................................................... 209
Table 11.50: READ BUFFER Command ................................................................................................. 210
Table 11.51: Read Buffer Command Parameters ..................................................................................... 211
-x-
Table 11.52: Read Buffer Command Mode Field Values......................................................................... 211

Table 11.53: WRITE BUFFER Command ............................................................................................... 213
Table 11.54: Write Buffer Command Parameters..................................................................................... 214
Table 11.55: Write Buffer Command Mode Field Values ........................................................................ 214
Table 11.56: Mode page code usage ......................................................................................................... 216
Table 11.57: UFS Mode parameter list ..................................................................................................... 217
Table 11.58: UFS Mode parameter header (10) ....................................................................................... 217
Table 11.59: Mode Parameter Header Detail............................................................................................ 218
Table 11.60: Page_0 mode page format.................................................................................................... 219
Table 11.61: Page 0 Format parameters.................................................................................................... 219
Table 11.62: Sub_page mode page format................................................................................................ 220
Table 11.63: Subpage Format parameters................................................................................................. 220
Table 11.64: UFS Supported Pages .......................................................................................................... 221
Table 11.65: Control Mode Page default value ........................................................................................ 222
Table 11.66: Control Mode Page Parameters ........................................................................................... 223
Table 11.67: Read-Write Error Recovery Mode Page default value ........................................................ 224
Table 11.68: Read-Write Error Recovery Parameters .............................................................................. 225
Table 11.69: Caching Mode Page default value ....................................................................................... 226
Table 11.70: Caching Mode Page Parameters .......................................................................................... 227
Table 12.1: RPMB Message Components ................................................................................................ 238
Table 12.2: Request Message Types ........................................................................................................ 239
Table 12.3: Response Message Types ...................................................................................................... 239
Table 12.4: RPMB Operation Result data structure.................................................................................. 240
Table 12.5: RPMB Operation Results....................................................................................................... 241
Table 12.6: RPMB Message Data Frame.................................................................................................. 242
Table 12.7: CDB format of Security Protocol In/Out commands ............................................................. 244
Table 12.8: Security Protocol specific field values ................................................................................... 245
Table 12.9: Supported security protocols SECURITY PROTOCOL IN parameter data ......................... 246
Table 12.10: UFS Supported security protocols SECURITY PROTOCOL IN parameter data ............... 246
Table 12.11: Certificate data SECURITY PROTOCOL IN parameter data............................................. 247
Table 12.12: UFS certificate data SECURITY PROTOCOL IN parameter data ..................................... 247
Table 12.13: Security Protocol Out command .......................................................................................... 248
Table 12.14: Expected Data Transfer Length value for Request Type Messages .................................... 248
Table 12.15: Ready To Transfer ............................................................................................................... 249
Table 12.16: RPMB message data frame .................................................................................................. 249
Table 12.17: RESPONSE UPIU ............................................................................................................... 250
Table 12.18: Response Type Message Delivery: COMMAND UPIU ..................................................... 251
Table 12.19: Expected Data Transfer Length value for Response Type Messages .................................. 251
Table 12.20: Response Type Message Delivery: DATA IN UPIU .......................................................... 252
Table 12.21: Response Type Message Delivery: RESPONSE UPIU ....................................................... 253
Table 13.1: bBootLunEn Attribute ........................................................................................................... 262
Table 13.2: Valid UPIUs and SCSI Commands for Each Initialization Phase ......................................... 267
Table 13.3: Logical unit configurable parameters .................................................................................... 272
Table 13.4: Parameter for controlling logical unit data reliability ............................................................ 285
-xi-
Table 13.5: Parameters for implementing RTT Rules .............................................................................. 296

Table 14.1: Descriptor identification values ............................................................................................. 299
Table 14.2: Generic Descriptor Format .................................................................................................... 303
Table 14.3: Logical Unit Descriptor Format ............................................................................................. 303
Table 14.4: Device Descriptor .................................................................................................................. 304
Table 14.5: wManufacturerID definition .................................................................................................. 309
Table 14.6: Configuration Descriptor Format........................................................................................... 310
Table 14.7: Configuration Descr. Header and Device Descr. Conf. parameters ...................................... 311
Table 14.8: Unit Descriptor configurable parameters ............................................................................... 312
Table 14.9: Geometry Descriptor.............................................................................................................. 313
Table 14.10: Unit Descriptor .................................................................................................................... 319
Table 14.11: RPMB Unit Descriptor ........................................................................................................ 322
Table 14.12: Power Parameters Descriptor............................................................................................... 324
Table 14.13: Interconnect Descriptor........................................................................................................ 325
Table 14.14: Manufacturer Name String .................................................................................................. 325
Table 14.15: Product Name String............................................................................................................ 326
Table 14.16: OEM_ID String ................................................................................................................... 326
Table 14.17: Serial Number String Descriptor ......................................................................................... 327
Table 14.18: Flags access properties......................................................................................................... 328
Table 14.19: Flags ..................................................................................................................................... 329
Table 14.20: Attributes access properties ................................................................................................. 333
Table 14.21: Attributes ............................................................................................................................. 334
-xii-
Foreword
This standard has been prepared by JEDEC. The purpose of this standard is definition of an UFS
Universal Flash Storage electrical interface and an UFS memory device. This standard defines a
unique UFS feature set and includes the feature set of eMMC Specification as a subset. This
standard references several other standard specifications by MIPI (M-PHY and UniPro
Specifications) and INCITS T10 (SBC, SPC and SAM draft standards) organizations.
Introduction
The UFS electrical interface is a universal serial communication bus which can be utilized for
different type of applications. It’s based on MIPI M-PHY standard as physical layer for
optimized performance and power. Architectural model references the INCITS T10 SAM model
for ease of adoption.
The UFS device is a universal data storage and communication media. It is designed to cover a
wide area of applications as smart phones, cameras, organizers, PDAs, digital recorders, MP3
players, internet tablets, electronic toys, etc.
-xiii-
-xiv-
Page 1
1 UNIVERSAL FLASH STORAGE (UFS), VERSION 2.0

2
3 (From JEDEC Board Ballot JCB-13-45, formulated under the cognizance of the
4 JC-64.1 Committee on Electrical Specifications and Command Protocols)
5
6
7 1 SCOPE
8
9 This standard specifies the characteristics of the UFS electrical interface and the memory device. Such
10 characteristics include (among others) low power consumption, high data throughput, low
11 electromagnetic interference and optimization for mass memory subsystem efficiency. The UFS electrical
12 interface is based on an advanced differential interface by MIPI M-PHY standard which together with the
13 MIPI UniPro standard forms the interconnect of the UFS interface. The architectural model is referencing
14 the INCITS T10 (SCSI) SAM standard and the command protocol is based on INCITS T10 (SCSI) SPC
15 and SBC standards.
16
17
18 2 NORMATIVE REFERENCE
19
20 The following normative documents contain provisions that, through reference in this text, constitute
21 provisions of this standard. For dated references, subsequent amendments to, or revisions of, any of these
22 publications do not apply. However, parties to agreements based on this standard are encouraged to
23 investigate the possibility of applying the most recent editions of the normative documents indicated. For
24 undated references, the latest edition of the normative document referred to applies.
25
26 [MIPI-M-PHY], MIPI Alliance Specification for M-PHYSM, Version 3.0
27 [MIPI-UniPro], MIPI Alliance Specification for Unified Protocol (UniProSM), Version 1.6
28 [MIPI-DDB], MIPI Alliance Specification for Device Descriptor Block (DDB), Version
29 [SAM], INCITS T10 draft standard: SCSI Architecture Model – 5 (SAM–5), Revision 05, 19 May 2010
30 [SPC], INCITS T10 draft standard: SCSI Primary Commands – 4 (SPC-4), Revision 27, 11 October 2010
31 [SBC], INCITS T10 draft standard: SCSI Block Commands – 3 (SBC–3), Revision 24, 05 August 2010
32
JEDEC Standard No. 220x
Page 2
33 3 TERMS AND DEFINITIONS

34
35 For the purposes of this standard, the terms and definitions given in the document included in clause 2
36 “Normative Reference” and the following apply.
37
38 3.1 Acronyms
BOOT_ID Boot Identification Number
CDB Command Descriptor Block
CPORT A CPort is a Service Access Point on the UniPro Transport Layer (L4) within a Device
that is used for Connection-oriented data transmission
CRB Command Request Block
DEVID Device ID
DID Device ID
DMA Direct Memory Access
DSC Digital Still Camera
EOF End of Packet
GB Gigabyte
HCI Host Controller Interface
HPQ High Priority Queue
KB Kilobyte
LUN Logical Unit Number
MB Megabyte
MIPI Mobile Industry Processor Interface
MP3 MPEG-2 Audio Layer 3
Mbps Mega bit per second
NA Not applicable
NU Not used
PDU Protocol Data Unit
PLL Phase-Locked Loop
PMP Portable media player,
PTR Pointer
PWM Pulse Width Modulation
RFU Reserved for future use
RPMB Replay Protected Memory Block
Page 3
39 3.1 Acronyms (cont’d)

40
SBC SCSI Block Commands
SID Segment ID
SDU Service Data Unit
SOF Start of Packet
SPC SCSI Primary Commands
SRB SCSI Request Block
TB Terabyte
T_PDU MIPI Unipro Protocol Data Unit
T_SDU MIPI Unipro protocol Service Data Unit
UFS Universal Flash Storage
UMPC Ultra-Mobile PC
UniPro Unified Protocol
UPIU UFS Protocol Information Unit
UTP UFS Transport Protocol
IU Information Unit
41
42 3.2 Terms and Definitions
43 Address Nexus: An address nexus is a combination of parameters that identify a connection between one
44 bus device to another. For the UFS bus and address nexus consists of a bus device ID for the source, a bus
45 device ID for the destination and a logical unit number for the destination.
46 Byte: An 8‐bit data value with most significant bit labeled as bit 7 and least significant bit as bit 0.
47 Command Descriptor Block: The structure used to communicate commands from an application client
48 to a device server. A CDB may have a fixed length of up to 16 bytes or a variable length of between 12
49 and 260 bytes.
50 Command Request Block: The bytes the make up a SCSI command that are encapsulated within a SCSI
51 Request Block
52 Device: An addressable device on the UFS bus usually a target that contains at least one LUN
53 Device ID: The bus address of a UFS device
54 Doubleword: A 32‐bit data value with most significant bit labeled as bit 31 and least significant bit as bit
55 0.
56 Dword: A 32‐bit data value, a Doubleword.
57 Gigabyte: 1,073,741,824 or 230 Bytes.
58 Host: An addressable device on the UFS bus which is usually the main CPU that hosts the UFS bus.
Page 4
59 3.2 Terms and Definitions (cont’d)

60 Initiator: An initiator is an addressable device on the UFS bus which is the originator of a command
61 request or message to a target device. As currently defined within UFS, the host or host controller is
62 always acts as the initiator. UFS devices cannot be initiators.
63 Kilobyte: 1024 or 210 Bytes.
64 Logical Unit: A logical unit is an internal entity of a bus device that performs a certain function or
65 addresses a particular space or configuration within a bus device. UFS devices can have up to eight
66 logical units.
67 Logical Unit Number: A numeric value that identifies a logical unit within a device
68 Megabyte: 1,048,576 or 220 Bytes.
69 Quadword: A 64‐bit data value with most significant bit labeled as bit 63 and least significant bit as 0.
70 Segment: A specified number of sequentially addressed bytes representing a data structure or section of
71 a data structure.
72 Segment ID: A 16‐bit value that represents an index into a table or an address of a segment descriptor or
73 simply an absolute value that is an element of an absolute address
74 SCSI Request Block: A data packet that contains a multi‐byte SCSI command and additional contextual
75 information needed to carry out the command operation. A SCSI Request Block is built by the host and is
76 targeted at a particular bus device.
77 Target: A target is an addressable device on the UFS bus which is the destination or target of a
78 command or message sent by an initiating device.
79 Task: A task is a SCSI command which includes all transactions to complete all data transfers and a
80 status response that will satisfy the requirements of the requested services of the command.
81 Transaction: A UFS bus primitive action which results in transmission of serial data packets between a
82 target and initiator
83 Terabyte: 1.099.511.627.776 or 240 Bytes.
84 UFS Protocol Information Unit: Information transfer (communication) between a UFS host and device
85 is done through messages which are called UFS Protocol Information Units. These messages are UFS
86 defined data structures that contain a number of sequentially addressed bytes arranged as various
87 information fields.
88 Unit: A bus device
89 Unit Attention: A condition of a bus device utilizing the SCSI protocol where it needs to be serviced
90 before it can continue processing requests and responses.
91 Word: A 16‐bit data value with most significant bit labeled as bit 15 and least significant bit as bit 0.
92
93
Page 5
94 3.3 Keywords
95 Several keywords are used to differentiate levels of requirements and options, as follow:
96 Can - A keyword used for statements of possibility and capability, whether material, physical, or causal
97 (can equals is able to).
98 Expected - A keyword used to describe the behavior of the hardware or software in the design models
99 assumed by this standard. Other hardware and software design models may also be implemented.
100 Ignored - A keyword that describes bits, bytes, quadlets, or fields whose values are not checked by the
101 recipient.
102 Mandatory - A keyword that indicates items required to be implemented as defined by this standard.
103 May - A keyword that indicates a course of action permissible within the limits of the standard (may
104 equals is permitted).
105 Must - The use of the word must is deprecated and shall not be used when stating mandatory
106 requirements; must is used only to describe unavoidable situations.
107 Optional - A keyword that describes features which are not required to be implemented by this standard.
108 However, if any optional feature defined by the standard is implemented, it shall be implemented as
109 defined by the standard.
110 Reserved - A keyword used to describe objects—bits, bytes, and fields—or the code values assigned to
111 these objects in cases where either the object or the code value is set aside for future standardization.
112 Usage and interpretation may be specified by future extensions to this or other standards. A reserved
113 object shall be zeroed or, upon development of a future standard, set to a value specified by such a
114 standard. The recipient of a reserved object shall not check its value. The recipient of a defined object
115 shall check its value and reject reserved code values.
116 Shall - A keyword that indicates a mandatory requirement strictly to be followed in order to conform to
117 the standard and from which no deviation is permitted (shall equals is required to). Designers are required
118 to implement all such mandatory requirements to assure interoperability with other products conforming
119 to this standard.
120 Should - A keyword used to indicate that among several possibilities one is recommended as particularly
121 suitable, without mentioning or excluding others; or that a certain course of action is preferred but not
122 necessarily required; or that (in the negative form) a certain course of action is deprecated but not
123 prohibited (should equals is recommended that).
124 Will - The use of the word will is deprecated and shall not be used when stating mandatory requirements;
125 will is only used in statements of fact.
126
127 3.4 Abbreviations
128 etc. - And so forth (Latin: et cetera)
129 e.g. - For example (Latin: exempli gratia)
130 i.e. - That is (Latin: id est)
131
132
Page 6
133 3.5 Conventions

134 This standard follows some conventions used in SCSI documents since it adopts several SCSI standards.
135 A binary number is represented in this standard by any sequence of digits consisting of only the Western-
136 Arabic numerals 0 and 1 immediately followed by a lower-case b (e.g., 0101b). Spaces may be included
137 in binary number representations to increase readability or delineate field boundaries (e.g., 0 0101 1010b).
138 A hexadecimal number is represented in this standard by any sequence of digits consisting of only the
139 Western-Arabic numerals 0 through 9 and/or the upper-case English letters A through F immediately
140 followed by a lower-case h (e.g., FA23h). Spaces may be included in hexadecimal number representations
141 to increase readability or delineate field boundaries (e.g., B FD8C FA23h).
142 A decimal number is represented in this standard by any sequence of digits consisting of only the
143 Western-Arabic numerals 0 through 9 not immediately followed by a lower-case b or lower-case h (e.g.,
144 25).
145 A range of numeric values is represented in this standard in the form "a to z", where a is the first value
146 included in the range, all values between a and z are included in the range, and z is the last value included
147 in the range (e.g., the representation "0h to 3h" includes the values 0h, 1h, 2h, and 3h).
148 When the value of the bit or field is not relevant, x or xx appears in place of a specific value.
149 The first letter of the name of a Flag is a lower-case f (e.g., fMyFlag).
150 The first letter of the name of a parameter included a Descriptor or the first letter of the name of an
151 Attribute is:
152  a lower-case b if the parameter or the Attribute size is one byte (e.g., bMyParameter),
153  a lower-case w if the parameter or the Attribute size is two bytes (e.g., wMyParameter),
154  a lower-case d if the parameter or the Attribute size is four bytes (e.g., dMyParameter),
155  a lower-case q if the parameter or the Attribute size is eight bytes (e.g., qMyParameter).
156
Page 7
157 4 INTRODUCTION
158 Universal Flash Storage (UFS) is a simple, high performance, mass storage device with a serial interface.
159 It is primarily for use in mobile systems, between host processing and mass storage memory devices. The
160 following is the summary of the UFS features.
161 4.1 General Features
162  Target performance
163 o High speed GEARs (1)
164  Support for GEAR1 is mandatory
165  Support for GEAR2 is mandatory
166  Support for GEAR3 is optional
167  Target host applications
168 o Mobile phone, UMPC, DSC, PMP, MP3 and any other applications that require mass storage,
169 bootable mass storage, and external card
170  Target device types
171 o External card
172  Micro size for mobile and portable devices
173  Full size or adaptor for DSC and large devices
174 o Embedded packages
175  Mass storage and bootable mass storage
176 o Future expansion of device class types
177  I/O devices, camera, wireless, … , etc.
178  Topology
179 o One device per UFS port. A topology to support multiple devices on a single interface is
180 planned for future revision
181  UFS Layering
182 o UFS Command Set Layer (UCS)
183  Simplified SCSI command set based on SBC and SPC. UFS will not modify these SBC and
184 SPC Compliant commands. Option for defining UFS Native command and future extension
185 exist.
186 o UFS Transport Protocol Layer (UTP)
187  JEDEC to define the supported protocol layer, i.e., UTP for SCSI. This does not exclude the
188 support of other protocol in UFS Transport Protocol Layer.
189 o UFS Interconnect Layer (UIC)
190  MIPI UniProSM [MIPI-UniPro] is adopted for data link layer
191  MIPI M-PHY SM [MIPI-M-PHY ] is adopted for physical layer
192 NOTE 1 See 6.5.1 for details.
Page 8
193 4.2 Interface Features

194  Three Power Supplies: separate Power Supply for I/O & Core
195 o VCCQ supply: 1.2V; logic, controller, and I/O
196 o VCCQ2 supply: 1.8V; Controller & IO
197 o VCC supply: 1.8/3.3 V ; i.e., NVM
198  Signaling as defined by MIPI M-PHY
199 o 400mVp/240mVp (not terminated),
200 o 200mVp/120mVp (terminated)
201  8b10b line coding, as defined by MIPI M-PHY
202  High reliability – BER under 10-10
203  Two signaling schemes supported
204 o Low-speed mode with PWM signaling scheme
205 o High-Speed burst mode
206  Multiple gears defined for both Low-Speed & High-Speed mode
207
208 4.3 Functional Features
209 UFS functional features are NAND management features. These include
210  Similar functional features as eMMC
211  Boot Operation Mode
212  Device enumeration & discovery
213  Supports Multiple partitions (LUNs) with partition Management
214  Supports Multiple User Data Partition with Enhanced User Data Area options
215  Support for boot partitions and RPMB partition
216  Reliable write operation
217  Background operations
218  Secure operations, Purge and Erase to enhance data security
219  Write Protection options, including Permanent & Power-On Write Protection
220  Signed access to a Replay Protected Memory Block
221  HW Reset Signals
222  Task management operations
223  Power management operations
Page 9
224 5 UFS ARCHITECTURE OVERVIEW
225 5.1 UFS Top level Architecture

226 Figure 5.1 shows the Universal Flash Storage (UFS) top level architecture.
Application Layer
UFS Command Set Layer (UCS)

Task
UFS Native Simplified SCSI Future
Device Manager Manager
Command Set Command Set Extension …
(QueryRequest)
UDM_SAP UTP_CMD_SAP UTP_TM_SAP
UFS Transport Protocol Layer (UTP)

UIO_SAP UIC_SAP
UFS InterConnect Layer (UIC)
MIPI UniPro
MIPI M-PHY
227
228 Figure 5.1 — UFS Top Level Architecture
229 UFS communication is a layered communication architecture. It is based on SCSI SAM architectural
230 model [SAM].
231 Application Layer
232 The application layer consists of the UFS command set layer (UCS), the device manager and the Task
233 Manager. The UCS will handle the normal commands like read, write, and so on. UFS may support
234 multiple command sets. UFS is designed to be protocol agnostic. This version UFS standard uses SCSI
235 as the baseline protocol layer. A simplified SCSI command set was selected for UFS. UFS Native
236 command set can be supported when it is needed to extend the UFS functionalities.
237 The Task Manager handles commands meant for command queue control. The Device Manager will
238 provide device level control like Query Request and lower level link-layer control.
239 UFS Device Manager
240 The device manager has the following two responsibilities:
241  Handling device level operations.
242  Managing device level configurations.
243 Device level operations include functions such as device sleep, device power down, power management
244 and other device specific operations. These mainly involve power management of the device.
245 Device level configuration is managed by the device manager by maintaining and storing a set of
246 descriptors. The device manager would handle commands like query request which is meant for
247 modifying and retrieving configuration information of the device.
248
Page 10
249 5.1 UFS Top level Architecture (cont’d)

250 Service Access Points
251 As seen from the diagram the device manager interacts with lower layers using the following two service
252 access points
253  UDM_SAP
254  UIO_SAP
255 UDM_SAP is the service access point exposed by the UTP for the device manager to allow handling of
256 device level operations and configurations. For example the handling of query request for descriptors
257 would be done using this service access point. The following diagram depicts the usage of the service
258 access point.
Device Manager
De Q
vi c u e
e ry R
Co e
nt qu
ro e s
l , e t,
tc.
UIO_SAP UDM_SAP
UFS InterConnect UFS Transport Protocol

Layer (UIC) Layer (UTP)
259
260 Figure 5.2 — Usage of UDM_SAP
261
262 UIO_SAP is the service access point exposed by the UIC layer for the device manager to trigger the reset
263 of the UIC layer and also to service a reset request from the host. The following diagram depicts the usage
264 of the service access point.
Device Manager
t, tc.
se e
r e se t ,
C
U I e re
vi c
De
UIO_SAP UDM_SAP
UFS InterConnect UFS Transport Protocol

Layer (UIC) Layer (UTP)
265
266 Figure 5.3 — Usage of UIO_SAP
Page 11
267 5.1 UFS Top level Architecture (cont’d)

268 UIO_SAP
269 UIO_SAP is the service access point exposed by the UIC layer. In UniPro, UIO_SAP corresponds to
270 DME_SAP. The DME_SAP provides service primitives including one for resetting the entire UniPro
271 protocol stack and one for UFS device reset, etc.
272  DME_RESET : It is used when the UniPro stack has to be reset.
273  DME_ENDPOINTRESET: It is used when UFS host wants the UFS device to perform a reset.
274 For the detailed internal mechanism, refer the UniPro specification [MIPI-UniPro] released by MIPI
275 (MIPI is Mobile Industry Processor Interface).
276 UDM_SAP
277 UDM_SAP is the service access point exposed by the UTP layer to the Device Manager for UFS device
278 level functions. UDM_SAP corresponds to the Query Request and Query Response functions defined by
279 the UFS UTP layer.
280 For further details refer to the following subclauses: 10.7.9 “Query Function transport protocol services”,
281 10.5.10 “QUERY REQUEST UPIU”, and 10.5.11 “QUERY RESPONSE UPIU”.
282 UFS Transport Protocol Layer
283 The UFS Transport Protocol (UTP) layer provides services for the higher layer . UPIU is “UFS Protocol
284 Information Unit” which is exchanged between UTP layers of UFS host and UFS device. For example, if
285 host side UTP receives the request from application layer or Device Manager, UTP generates an UPIU for
286 that request and transports the generated UPIU to the peer UTP in UFS device side. The UTP layer
287 provides the following three access points.
288 1) UFS Device Manager Service Access Point (UDM_SAP) to perform the device level management
289 like descriptor access.
290 2) UTP Command Service Access Point (UTP_CMD_SAP) to transport commands.
291 3) UTP Task Management Service Access Point (UTP_TM_SAP) to transport task-management
292 function like “abort task” function.
293 UFS Interconnect Layer
294 The lowest layer is UFS Interconnect Layer (UIC) which handles connection between UFS host and UFS
295 device. UIC consists of MIPI UniPro and MIPI M-PHY. The UIC provides two service access points to
296 upper layer. The UIC Service Access Point (UIC_SAP) to transport UPIU between UFS host and UFS
297 device. The UIC_SAP corresponds to T_SAP in UniPro. The UIC IO control Service Access Point
298 (UIO_SAP) to manage UIC. The UIO_SAP corresponds to DME_SAP in UniPro.
299 UFS Topology
300 This version of the standard assumes that only one device is connected to an UFS port. Other topologies
301 may be defined in future versions of the standard.
302
303
Page 12
304 5.2 UFS System Model

305 The Figure 5.4 shows an example of UFS system. It shows how an UFS host is connected to an UFS
306 device, the position of UFS host controller and its related UFS HCI interface.
UFS Host UFS Device
Application
Device
Level Descriptors
RESET_n Managing
REF_CLK Control Config

UFS Host
Driver Controller UIC UIC
LU-0 Storage
DOUT_t
MIPI M-PHYSM
MIPI M-PHYSM
MIPI UniProSM
MIPI UniProSM
UFS DOUT_c
UFS
Host
Driver DIN_t
Reg
LU-N Storage
DIN_c
307
308 Figure 5.4 — UFS System Model
309 The UFS host consists of the application which wishes to communicate with the UFS device. It
310 communicates with the device using the UFS driver. The UFS driver is meant for managing the UFS host
311 controller through the UFS-HCI (UFS Host Controller Interface). The UFS-HCI is basically a set of
312 registers exposed by the host controller.
313 Figure 5-4 also indicates the UFS interface between the UFS host and the UFS device. The UFS
314 Interconnect (UIC) Layer consists of MIPI UniPro and MIPI M-PHY. The physical layer M‐PHY is
315 differential, dual simplex PHY that includes TX and RX pairs.
316 Potential UFS devices can be memory card (full size and micro size), embedded bootable mass storage
317 devices, IO devices etc. An UFS device comprises of multiple logical units, device manager and
318 descriptors. The device manager performs device level functions like power management while the
319 logical unit performs functions like read, write etc. The descriptors are meant for storage of configuration
320 related information.
321
322 5.3 System Boot and Enumeration
323 The system boot from a bootable UFS device will initiate after power up when the UFS InterConnect
324 Layer (MIPI M-PHY and UniPro) has completed its boot sequence. The boot code can be read from the
325 appropriate boot logical unit, or as desired, boot ROM code can re-configure MIPI M-PHY and UniPro
326 to appropriate setting before reading code from boot partition.
327 Multiple boot logical units may be available in an UFS device. However, only one logical unit will be
328 active at power-up. Appropriate descriptors are available to configure the boot process.
329 During boot, accesses to boot logical unit are supported via SCSI commands.
Page 13
330 5.4 UFS Interconnect (UIC) Layer

331 UFS interconnect layer is composed by MIPI UniPro, which provides basic transfer capabilities to the
332 upper layer (UTP), and MIPI M-PHY, adopted as UFS physical layer.
333 5.4.1 UFS Physical Layer Signals
334 The UFS Physical layer defines the PHY portion of the UFS interface that connects UFS device and UFS
335 host. This is based on MIPI M-PHY specification. UFS interface can support multiple lanes. Each lane
336 consists of a differential pair. Basic configuration is based on one transmit lane and one receive lane.
337 Optionally, an UFS device may support two downstream lanes and two upstream lanes. An equal number
338 of downstream and upstream lanes shall be provided in each link.
339 Table 5.1 summarizes the basic signals required for an embedded UFS device. Only the single lane, per
340 direction, per link, configuration is shown. A memory card solution would require a subset of these
341 signals. See clause 6 “UFS Electrical: Clock, Reset, Signals and Supplies” and clause 8 “UFS UIC
342 Layer: MIPI M-PHY” for full details about UFS signals.
343 Table 5.1 — UFS Signals
Name Type Description
Reference clock
REF_CLK Input Relatively low speed clock common to all UFS devices in the chain,
used as a reference for the PLL in each device.
DIN_t Downstream lane input

Input
DIN_c Differential input true and complement signal pair.
DOUT_t Upstream lane output

Output
DOUT_c Differential output true and complement signal pair.
Reset
RST_n Input
UFS Device hardware reset signal
344 5.4.2 MIPI UniPro

345 In UFS, UniPro is responsible for management of the link, including the PHY.
346 NOTE Device management is outside the scope of the interconnect layer and is the responsibility of the upper
347 layers.
348 The basic interface to the interconnect layer is UniPro definition of a CPort. CPort is used for all data
349 transfer as well as all control and configuration messages. In general, multiple CPorts can be supported on
350 a device and the number of CPorts is implementation dependent.
351 Traffic sent over UniPro link can be classified as TC0 or TC1 traffic class with TC1 as higher priority
352 traffic class. This version of UFS standard only uses a single CPort and TC0 traffic class.
353 UFS takes advantage of the basic types of UniPro services. These include data transfer service, and
354 config/control/status service.
355 For more details, please refer to clause 9 “UIC layer: MIPI UniPro” and MIPI UniPro specification
356 [MIPI-UniPro].
Page 14
357 5.4 UFS Interconnect (UIC) Layer (cont’d)

358 5.4.3 MIPI UniPro Related Attributes
359 In general the UniPro related attributes, values and use of them are defined in the MIPI UniPro
360 Specification. The attributes may be generic for all UniPro applications and thus out of scope of this
361 document. Following attributes are still defined in this standard specifically for UFS application as
362 indicated in Table 5.2.
363 Table 5.2 — ManufacturerID and DeviceClass Attributes
(1)
Attribute AttributeID Value Description
MIPI manufacturer ID.
DME_DDBL1_ManufacturerID 0x5003 MIPI MID shall be used in this

Attribute also for UFS applications.
The ID can be requested from MIPI.
Memory = 0x02 UniPro DeviceClass ID for UFS

DME_DDBL1_DeviceClass 0x5002
Host = 0x03 application
NOTE 1 Reference MIPI Alliance Specification for Device Descriptor Block [MIPI-DDB]
364
365 5.5 UFS Transport Protocol (UTP) Layer
366 As mentioned previously, the Transport Layer is responsible for encapsulating the protocol into the
367 appropriate frame structure for the interconnect layer. UFS is protocol agnostic and thus any protocol will
368 need the appropriate translation layer. For this version of UFS standard, this is UTP (UFS Transport
369 Protocol) layer.
370 In this version of the standard, all accesses are supported only through SCSI, however additional
371 API/service/extension may be added in future versions to introduce new features or address specific
372 requirements.
373 A design feature of UTP is to provide a flexible packet architecture that will assist the UFS controller in
374 directing the encapsulated command, data and status packets into and out of system memory. The
375 intention is to allow the rapid transmittal of data between the host system memory and the UFS device
376 with minimal host processor intervention. Once the data structures are set up in host memory and the
377 target device is notified, the entire commanded transaction can take place between the UFS device and the
378 host memory. The means by which the UFS controller transfers data into and out of host memory is via a
379 hardware and/or firmware mechanism that is beyond the scope of this document. See the UFS controller
380 standard for further information.
381 A second feature of the UTP design is that once a device receives a command request notification from
382 the host, the device will control the pacing and state transitions needed to satisfy the data transfers and
383 status completion of the request. The idea here is that the device knows its internal condition and state and
384 when and how to best transfer the data that makes up the request. It is not necessary for the host system or
385 controller to continuously poll the device for “ready” status or for the host to estimate when to start a
386 packet transfer. The device will start the bus transactions when it determines its conditions and status are
387 optimal. This approach cuts down on the firmware and logic needed within the host to communicate with
388 a device. It also affords the maximum possible throughput with the minimum number of bus transactions
389 needed to complete the operation.
Page 15
390 5.5 UFS Transport Protocol (UTP) Layer (cont’d)

391
392 5.5.1 Architectural Model
393 The SCSI Architecture Model [SAM] is used as the general architectural model for UTP. The SAM
394 architecture is a client‐server model or more commonly a request‐response architecture.
395
396 5.5.1.1 Client-Server Model
397 A client-server transaction is represented as a procedure call with inputs supplied by the application client
398 on the Initiator. The procedure call is processed by the server and returns outputs and a procedure call
399 status. Client-server relationships are not symmetrical. A client only originates requests for service. A
400 server only responds to such requests.
401 Initiator (host) and Target (UFS device) are mapped into UFS physical network devices. An Initiator may
402 request processing of a command or a task management function through a request directed to the Target.
403 Device service requests are used to request the processing of commands and task manager requests are
404 used to request the processing of task management functions.
405 Target is a Logical Unit (LU) contained within a UFS device. A UFS device will contain one or more
406 Logical Units. A Logical Unit is an independent processing entity within the device.
407 An Initiator request is directed to a single Logical Unit within a device. A Logical Unit will receive and
408 process the client command or request. Each Logical Unit has an address within the Target device called a
409 Logical Unit Number (LUN).
410 Communication between the Initiator and Target is divided into a series of messages. These messages are
411 formatted into UFS Protocol Information Units (UPIU) as defined within this specification. There are a
412 number of different UPIU types defined. All UPIU structures contain a common header area at the
413 beginning of the data structure (lowest address). The remaining fields of the structure vary according to
414 the type of UPIU.
415 A Task is a command or sequence of actions that perform a requested service. A Logical Unit contains a
416 task queue that will support the processing of one or more Tasks. The Task queue is managed by the
417 Logical Unit. A unique Initiator provided Task Tag is generated by the Initiator when building the Task.
418 This Task Tag is used by the Target and the Initiator to distinguish between multiple Tasks. All
419 transactions and sequences associated with a particular Task will contain that Task Tag in the transaction
420 associated data structures.
421 Command structures consist of Command Descriptor Blocks (CDB) that contain a command opcode and
422 related parameters, flags and attributes. The description of the CDB content and structure are defined in
423 detail in the [SAM], [SBC] and [SPC] INCITS T10 draft standards.
Page 16
424 5.5.1.1 Client-Server Model (cont’d)

425
426
427 Figure 5.5 — SCSI Domain Class Diagram
J EDEC Standard No. 220B
Page 17
428 5.5.1.1 Client-Server Model (cont’d)

429
UFS Target (Device) UFS Port UFS Initiator (Host)
1 1 1 1 1 1 1
1 1 1 1 1..*
Device
1 UFS Target Port UFS Initiator Port Application Client
Manager
1 routes to 1 1 1..*
routes to
1..*
1
UFS Unit Task Router
1..* 1 1
1 1
routes to
1 1
Device Server Task Manager
430
431 Figure 5.6 — UFS Domain Class Diagram
432
Page 18
433 5.5.1.2 CDB, Status, Task Management

434 UTP adopts Command Descriptor Block (CDB) format for commands, device status data hierarchy and
435 reporting method, and task management functions of outstanding commands, described in [SAM].
436 Regardless of the command protocol to be delivered by UTP, SCSI CDB, Status and Task Management
437 Functions should be adopted uniformly in UFS devices.
438 5.5.1.3 Nexus
439 The nexus represents the relationship among the Initiator, Target, Logical Unit and Command (Task)
440  Nexus notation: I_T_L_Q nexus; where I =Initiator, T = Target, L = Logical Unit, Q =
441 Command
442 There shall only be one Initiator, the host, and one target, the UFS device in UFS definition. There shall
443 be one or more logical units in a UFS device. The command identifier (i.e., the Q in an I_T_L_Q nexus)
444 is assigned by the Initiator to uniquely identify one command in the context of a particular I_T_L nexus,
445 allowing more than one command to be outstanding for the I_T_L nexus at the same time.
446 An overlapped command occurs when a task manager or a task router detects the use of a duplicate
447 I_T_L_Q nexus in a command before that I_T_L_Q nexus completes its command lifetime (see [SAM]).
448 Concurrent overlapped commands are not allowed in UFS. Each command shall have an unique Task
449 Tag. The UFS device is not required to detect overlapped commands.
450 5.5.1.4 SCSI Command Model
451 All command requests originate from application clients in an Initiator. An application Client requests the
452 processing of a command with the following procedure call:
453  Service Response = Execute Command (IN (I_T_L_Q Nexus, CDB, Task Attribute, [Data-In
454 Buffer Size], [Data-Out Buffer], [Data-Out Buffer Size], [CRN], [Command Priority]), OUT
455 ([Data-In Buffer], [Sense Data], [Sense Data Length], Status, [Status Qualifier]))
456 Parameter fields in the UTP Command, Response, Ready-to-Transfer, Data-Out, Data-In UPIU headers
457 contain the requisite information for the input and output arguments of the Execute Command procedure
458 call in compliance with [SAM].
459 5.5.1.5 SCSI Task Management Functions
460 An application client requests the processing of a task management function with the following procedure
461 call:
462  Service Response = Function name (IN (Nexus), OUT ([Additional Response Information])
463 Parameters fields in the UTP Task Management Request and UTP Task Management Response headers
464 contain the requisite information for the input and output arguments of the Task Management Function
465 procedure call in compliance with [SAM].
466
467
Page 19
468 5.6 UFS Application and Command Layer

469 UFS interface is designed to be protocol agnostic interface. However, as mentioned previously, SCSI has
470 been selected as the baseline protocol layer for this standard. Descriptors are available to identify and
471 select the appropriate protocol for UFS interface.
472 The primary functions of the Command Set Layer are to establish a method of data exchange between the
473 UFS host and UFS device and to provide fundamental device management capability. SCSI SBC and
474 SPC commands are the baseline for UFS. UFS will not modify the SBC and SPC Compliant commands.
475 The goal is to maximize re-use and leverage of the software codebase available on platforms (PC,
476 netbook, MID) that are already supporting SCSI.
477 Options are available to define UFS Native commands and extension as needed.
478 UFS SCSI command set includes
479 1. SBC compliant commands [SBC]:
480  FORMAT UNIT
481  READ(6) and READ(10)
482  READ CAPACITY(10)
483  REQUEST SENSE
484  SEND DIAGNOSTIC
485  UNMAP
486  WRITE (6) and WRITE (10)
487 2. SPC compliant commands [SPC]:
488  INQUIRY
489  REPORT LUNS
490  READ BUFFER (optional)
491  TEST UNIT READY
492  WRITE BUFFER (optional)
493  SECURITY PROTOCOL IN
494  SECURITY PROTOCOL OUT
495 3. SCSI operational commands for UFS applications and compatible with existing SCSI driver
496  MODE SELECT (10)
497  MODE SENSE (10)
498  PRE-FETCH (10)
499  START STOP UNIT
500  SYNCHRONIZE CACHE (10)
501  VERIFY (10)
502 4. Value-added optional commands for UFS:
503  READ(16), WRITE(16), PRE-FETCH (16), SYNCHRONIZE CACHE (16), and READ
504 CAPACITY(16), applicable to block device with capacity larger than 2 TByte in any logical
505 unit.
506 Please refer to clause 11 “UFS Protocol layer – SCSI Commands” for more details.
507
Page 20
508 6 UFS ELECTRICAL: CLOCK, RESET, SIGNALS AND SUPPLIES
509 6.1 Embedded UFS Signals
510
511 Figure 6.1 represents a conceptual drawing of UFS memory device. Utilization of internal regulators and
512 connection of those to different parts of the sub-system may differ per implementation.
VCC VCCQ VCCQ2
CCP-IN
VDDi
CVDDi
VCC VCCQ VCCQ2
Regulator Regulator Regulator
C+ VDDiQ
CVDDiQ
CCP C-
CPOUT1 VDDiQ2
CCP-OUT Charge
Pump CVDDiQ2
CPOUT2
RST_n
Control Memory
REF_CLK Memory
Nand IO
UFS IO
Block
Block
DIN_t/c
Core Logic Data
Block
DOUT_t/c
VSS VSS
513
514
515 NOTE 1 The memory core power supply may be connected to VCC power supply ball , or the VCC regulator
516 output, while it shall be connected to the charge pump output if VCC =1.8V and the memory requires 3.3V core
517 power supply.
518 NOTE 2 The memory IO power supply may be connected to VCCQ2 power supply ball, or the VCCQ2 regulator
519 output.
520 NOTE 3 CCP-IN, CCP and CCP-OUT may be required only when internal charge pump is used.
521
522 Figure 6.1 — UFS Device Block Diagram
523
Page 21
524 6.1 Embedded UFS Signals (cont’d)

525 Table 6.1 — Signal Name and Definitions
Name Type Description
VCC Supply Supply voltage for the memory devices
Supply voltage used typically for the memory controller and
VCCQ Supply optionally for the PHY interface and any other internal very low
voltage block
Supply voltage used typically for the PHY interface and the
VCCQ2 Supply
memory controller and any other internal low voltage block
(1) Input terminal to provided bypass capacitor for VCCQ internal
VDDiQ Input
regulator typically related to the memory controller
(1) Input terminal to provide bypass capacitor for VCCQ2 internal
VDDiQ2 Input
regulator, typically related to memory IF
(1) Input terminal to provide bypass capacitor for VCC internal
VDDi Input
regulator
VSS Supply Ground
RST_n Input Input hardware reset signal. This is an active low signal
Input reference clock. When not active, this signal should be

REF_CLK Input
pull-down or driven low by the host SoC.
Differential input signals into UFS device from the host

(2)
DIN_t or DIN0_t Downstream data lane 0.
(2) Input
DIN_c or DIN0_c DIN_t is the positive node of the differential signal.
(2) (2)
DIN1_t , DIN1_c Input Downstream data lane 1.
Differential output signals from the UFS device to the host
(3)
DOUT_t or DOUT0_t Upstream data lane 0.
(3) Output
DOUT_c or DOUT0_c DOUT_t is the positive node of the differential signal.
(3) (3)
DOUT1_t , DOUT1_c Output Upstream data lane 1.
Optional charge pump capacitor, positive terminal. For more
C+ Input
information, please refer to 6.6
Optional charge pump capacitor, negative terminal. For more
C- Input
Optional Charge pump output capacitor terminal. For more
CPOUT1, CPOUT2 Input
NOTE 1 If there is no internal regulator requiring output capacitor then VDDi pins should be internally connected
as follows: VDDi to VCC, VDDiQ to VCCQ, and VDDiQ2 to VCCQ2.
NOTE 2 DIN0_t/_c and DIN1_t/_c apply if the device has two downstream lanes.
NOTE 3 DOUT0_t/_c and DOUT1_t/_c apply if the device has two upstream lanes.
526 6.2 UFS Memory Card Signals

527 [Reserved for future Memory Card definition]
Page 22
528 6.3 Reset Signal

529 To meet the requirements of the JEDEC standard JESD8-12A, the RST_n signal voltages shall be within
530 the following specified ranges for VCCQ.
531 Table 6.2 — Reset Signal Electrical Parameters
Parameter Symbol Min Max Unit Notes
Input HIGH voltage VIH 0.65*VCCQ VCCQ+0.3 V For VCCQ as defined in Table 6.3
Input LOW voltage VIL VSS-0.3 0. 35*VCCQ V For VCCQ as defined in Table 6.3
Input Capacitance Cin 10 pF
Input leakage Current Ilkg 10 µA
532 6.4 Power Supplies

533 Table 6.3 — UFS Supply Voltages
2.7 3.6 V
Supply Voltage (memory) VCC
1.70 1.95 V
Supply Voltage (controller and IO) VCCQ 1.1 1.3 V JESD8-12A
Supply Voltage (secondary for controller and IO) VCCQ2 1.70 1.95 V
Supply power-up for 3.3V tPRUH 35 ms
Supply power-up for 1.8V tPRUL 25 ms

Supply power-up for 1.2V tPRUV 20 ms
VCC internal regulator capacitor CVDDi 1 µF
VCCQ internal regulator capacitor CVDDiQ 1 µF

VCCQ2 internal regulator capacitor CVDDiQ2 0.1 µF
534 UFS device must support at least one of the valid voltage configurations, and can optionally support all
535 valid voltage configurations highlighted within the table below.
536 Table 6.4 — Voltage configurations for Embedded UFS
VCCQ VCCQ2
Embedded UFS
1.1V-1.3V 1.65V-1.95V
2.7V-3.6V Valid
VCC
1.7V-1.95V Valid
537
538 Table 6.5 — Voltage configurations for UFS Card
VCCQ
UFS Card
1.1V-1.3V
2.7V-3.6V Valid
VCC
1.7V-1.95V Not Valid

Page 23
539 6.5 Reference Clock

540 The M-PHY specification defines the reference clock optional for the State Machine Type I [MIPI M-
541 PHY]. As the PWM signaling is self-clocked the reference clock is not required for the data latching. Still
542 existence of the reference clock may be utilized to enable lower BER and faster HS mode PLL/DLL
543 locking. Thus a UFS memory device shall implement a square wave single ended reference clock input
544 and it requires the presence of a reference clock with the characteristics described in this section.
545 Table 6.6 — Reference Clock parameters
19.2
26
Frequency fref MHz 1
38.4
52
Frequency Error fERROR -150 +150 ppm
Input High Voltage VIH 0.65 * VCCQ V 2
Input Low Voltage VIL 0.35 * VCCQ V 2
Input Clock Rise Time tIRISE 2 ns 3
Input Clock Fall Time tIFALL 2 ns 3
Duty Cycle tDC 45 55 % 4
Phase Noise N -66 dBc 5
Noise Floor Density Ndensity -140 dBc/Hz 6
RLRX 100 kΩ
Input Impedance 7
CLRX 5 pF
NOTE 1 HS-BURST rates A and B are achieved with integer multipliers of fref.
NOTE 2 Figure 6.2 shows the input levels VIL,MAX to VIH,MIN.
NOTE 3 Clock rise time and clock fall time shall be measured from 20% to 80% of the window
defined by VIL,MAX to VIH,MIN, see Figure 6.2.
NOTE 4 Clock duty cycle shall be measured at the crossings of the REF_CLK signal with the
midpoint VMID, defined as: VMID = (VIL,MAX + VIH,MIN) / 2, see Figure 6.2.
NOTE 5 Integrated single side band phase noise from 50kHZ to 10MHz. This parameter refers
to the random jitter only.
NOTE 6 White noise floor. This parameter refers to the random jitter only.
NOTE 7 RLRX and CLRX include Rx package and Rx input impedance.
546
547
Page 24
548 6.5 Reference Clock (cont’d)

549 Figure 6.2 shows clock rise time and fall time measurements.
VCCQ
VIH,MIN
80%
tIRISE
VMID
tIFALL
20%
VIL,MAX
VSS
550
551 Figure 6.2 — Clock input levels, rise time, and fall time
552 6.5.1 HS Gear Rates
553 Table 6.7 defines the data rate values for the two rate series with respect REF_CLK frequency value
554 (fref).
555 Table 6.7 — HS-BURST Rates
(3)
Rate A-series Rate B-series
HS-GEAR Rate A-series Rate B-series (from (from Unit
[MIPI-M-PHY]) [MIPI-M-PHY])
fref fref fref fref
19.2 / 38.4 / 26 /
19.2 / 38.4 26 / 52 19.2 / 38.4 / 26 / 52 MHz
52
(1)
HS-GEAR1 1248 1459.2 1456.0 1248 1457.6 Mbps
HS-GEAR2 2496 2918.4 2912.0 2496 2915.2 Mbps

(2)
HS-GEAR3 4992 5836.8 5824.0 4992 5830.4 Mbps
NOTE 1 1248Mbs with fref = 38.4MHz may be obtained using a prescaler. fref * M /P, M = 65 (PLL multiplier) , P = 2
(Prescaler).
NOTE 2 Support for HS-GEAR3 is optional.
NOTE 3 The B-series rates shown are not integer multiples of common reference frequencies 19.2 MHz or 26 MHz,
but are within the tolerance range of 2000 ppm.
Page 25
556 6.5 Reference Clock (cont’d)

557 6.5.2 Host Controller requirements for reference clock generation
558 Table 6.8 — Host controller reference clock parameters
DC Output High Voltage VOH 0.75 * VCCQ V 1, 2
DC Output Low Voltage VOL 0.25 * VCCQ V 1, 2
Output Clock Rise Time tORISE 2 ns 3
Output Clock Fall Time tOFALL 2 ns 3
RLTest 100 kΩ 1, 4, 5
Test Load Impedance
CLTest 20 pF 1, 4, 5
NOTE 1 Output load resistive and capacitance component are defined as 20 pF shunted by 100 KΩ.
REF_CLK
TX
20pF
VRefClk 100KΩ
VSS
Figure 6.3 — Test Load Impedance

NOTE 2 Following graph shows Output driver and Input receiver levels. REF_CLK driver AC voltage (e.g., ring
back) shall be kept inside Output Voltage limit.
VCCQ MAX
TX Output High RX Input High

VOH, MIN
VIH, MIN
RX
Threshold
Region
VIL, MAX
VOL, MAX
TX Output Low RX Input Low
VSS
Transmitter Receiver
Figure 6.4 — Output driver and Input receiver levels
Page 26
559 6.5.2 Host Controller requirements for reference clock generation (cont’d)
Table 6.8 — Host controller reference clock parameters (cont’d)
NOTE 3 Clock rise time and clock fall time shall be measured from 20% to 80% of the window defined by
VOL,MAX and VOH,MIN.
VCCQ
VOH,MIN
80%
tORISE
tOFALL
20%
VOL,MAX
VSS
Figure 6.5 — Clock output levels, rise time and fall time
NOTE 4 Including transmitter output, Tx package, interconnect, Rx package and Rx input impedance
NOTE 5 The Test Load Impedance is placed at the output of the driver, with the shortest interconnect.
560
561 6.6 External Charge Pump Capacitors (Optional)
562 In order to produce memory devices that can accommodate a low voltage core supply (Vcc=1.8v) an
563 internal charge pump circuit may be required.
564 Charge pump circuit requires extra-sized passive components. An optional usage of external Charge
565 pump capacitors is provided.
566 Figure 6.1 shows the electrical connections required in case of charge pump implementation that uses
567 external capacitors.
568 Table 6.8 provides description of the capacitors to be used.
569 Table 6.9 — Charge pump capacitors description
Capacitor Name Min Typ Max Description
When charge pump is used, this capacitor is used as
the charge pump input bypass capacitor.
CCP-IN TBD 4.7uF TBD
When charge pump is not used this capacitor is used
as a bypass capacitor for the memory.
CCP-OUT TBD 4.7uF TBD Charge pump output bypass capacitor
CCP TBD 0.22uF TBD Charge pump flying capacitor
570 The charge pump capacitors are optional for embedded UFS devices. Even though all defined embedded
571 UFS packages shall include ball placement for the given optional capacitors. The ball names and
572 description are given in Table 6.10.
Page 27
573 6.6 External Charge Pump Capacitors (Optional) (cont’d)

574 Table 6.10 — Charge pump related ball names
Ball Name Description
C+ CCP capacitor’s positive terminal
C- CCP capacitor’s negative terminal
1
CPOUT1, CPOUT2 Charge pump output capacitor (2 balls)
NOTE 1 Two CPOUT balls are required to reduce inductance, improve ripple and transient response
NOTE 2 The given capacitors shall be placed close to the memory device to minimize the inductance. As a
guideline for package design, it is recommended to place the CP related balls close to each other and close to the
edge of the package.
575
576 6.7 Absolute Maximum DC Ratings
577 Stresses greater than those listed in Table 6.11 may cause permanent damage to the device. This is a stress
578 rating only, and functional operation of the device at these or any other conditions above those indicated
579 in the operational sections of this specification is not implied. Exposure to absolute maximum rating
580 conditions for extended periods may affect reliability.
581 Table 6.11 — Absolute maximum DC ratings
Voltage on M-PHY signals - 0.2 1.6 V 1
Voltage on REF_CLK, RST_n signals - 0.2 1.6 V 1
VCC supply voltage VCC - 0.6 4.6 V 1
VCCQ supply voltage VCCQ - 0.2 1.6 V 1
VCCQ2 supply voltage VCCQ2 - 0.2 2.4 V 1
Storage Temperature TSTG -40 85 °C
NOTE 1 Voltage relative to VSS.
582
583
584
Page 28
585 7 RESET, POWER-UP AND POWER-DOWN
586 7.1 Reset

587 Following sub-sections define the means for resetting the UFS device or a layer of it.
588 7.1.1 Power-on Reset
589 The host may reset the UFS device by switching the VCCQ and VCCQ2 (and VCC) power supplies off
590 and back on. The UFS device shall have its own power-on detection circuitry which puts the UFS device
591 and all the different layers of it into a defined state after the power-on.
Host Device
LU 1 Logical Unit LU n Logical Unit
Reset ... Reset
Application Power on
Events
Client
Power on
Events Hard
Reset
Hard
Reset
Device Manager
1. DME_RESET.req 1. DME_RESET.req
2. DME_RESET.cnf_L 2. DME_RESET.cnf_L
DME DME
SAP SAP
Transport Transport
T_LM
T_LM
SAP
SAP
Device Management Entity (DME)
Layer (L4) Layer (L4)
Network Network
N_LM
N_LM
SAP
SAP
Legend
DL_LM
DL_LM
Data Link Data Link

SAP
SAP

Event
Action
PA_LM
PA_LM
PHY Adapter PHY Adapter

SAP
SAP
Layer (L1.5) Layer (L1.5)
592
593 Figure 7.1 — Power-on Reset
594
Page 29
595 7.1.2 Hardware Reset

596 A dedicated hardware reset signal is also defined for the UFS device. This signal is applicable for
597 embedded UFS devices only.
Host Device
Reset ... Reset
Application HW Reset
Event
Client
HW Reset
Event Hard
Reset
Hard
Reset
Device Manager
1. DME_RESET.req 1. DME_RESET.req
2. DME_RESET.cnf_L 2. DME_RESET.cnf_L
DME DME
SAP SAP
Transport Transport
T_LM
T_LM
SAP
SAP

Network Network
N_LM
N_LM
SAP
SAP
Legend
DL_LM
DL_LM
Data Link Data Link

SAP
SAP

Event
Action
PA_LM
PA_LM

SAP
SAP
598
599 Figure 7.2 — Hardware Reset
600 Figure 7.3 shows the hardware reset AC timings.
RST_n
tRSTW tRSTH
601
602 Figure 7.3 — Reset AC timings
603 Table 7.1 — Reset timing parameters
Symbol Comment Min Max Unit
tRSTW RST_n Pulse Width 1 µs
tRSTH RST_n High Period (Interval) 1 µs
1
tRSTF RST_n filter 100 ns
604 The UFS device must not detect 100ns or less of positive or negative RST_n pulse. The UFS device must
605 detect more than or equal to 1us of positive or negative RST_n pulse width.
606
Page 30
607 7.1.3 EndPointReset

608 The EndPointReset feature is defined in the MIPI UniPro Specification.
609 Function call from Host Application Client to Host UniPro via DME_SAP:DME_ENDPOINTRESET.req
610 =1
611 Device Manager shall receive the EndPointReset function call from the device UniPro via DME_SAP and
612 executes the EndPointReset function.
613 A UFS device shall completely reset itself on reception of an EndPointReset: UFS Flags (except Power
614 on reset UFS Flags), UFS Attribute (except Power on reset UFS Attributes), UFS Descriptor, UniPro
615 attributes are reset to their default value and the UniPro link startup is initiated.
616 The device may need to be configured again since attributes are reset to their default value. Further,
617 downloading the boot code from the UFS device is optional, and is based on system-level conditions.
618 A UFS Host should ignore the reception of an EndPointReset from a UFS device.
Host Device
Reset ... Reset
Application Hard
Device Manager
Client Reset
Endpoint Reset
1. DME_ENDPOINTRESET.req 5. DME_ENDPOINTRESET.ind
DME DME
SAP SAP
Transport Transport
T_LM
T_LM
SAP
SAP
Network Network
N_LM
N_LM
SAP
SAP
Legend
DL_LM
DL_LM
Data Link Data Link

SAP
SAP

Event
3. TRG_EPR Action
PA_LM
PA_LM

SAP
SAP
2. PA_LM_ENDPOINTRESET.req 4. PA_LM_ENDPOINTRESET.ind
619
620 Figure 7.4 — EndPointReset
621
Page 31
622 7.1.4 Logical Unit Reset

623 The Logical Unit Reset feature is defined in the SCSI Architectural Model [SAM]. This reset is triggered
624 via the SCSI Task Management features described in 10.7.8.4.
625 LU reset (LU 0, ... , LU 7):
626 Function Call from Host Application Client to Host UTP via UTP_TM_SAP: Task management
627 LOGICAL UNIT RESET (IN ( I_T_L Nexus )).
628 LU Task manager shall receive the function call from device UTP via UTP_TM_SAP and executes the
629 LU reset function.
630 NOTE The Logical Unit Reset does not set the device parameters to their default value, therefore it is not
631 recommended to use Logical Unit Reset to prepare the UFS device for a system boot.
Host Device
Reset ... Reset
Application
Client
Processing a LOGICAL
Task Mgmt UNIT RESET Task
Request Mgmt Req.
Device Manager
(LOGICAL
UNIT RESET
LU n)
Task Mgmt Request

(LOGICAL UNIT RESET LU n)
DME DME
SAP SAP
T_SAP T_SAP
Transport Transport
T_LM
T_LM
SAP
SAP
Network Network
N_LM
N_LM
SAP
SAP
Legend
DL_LM
DL_LM
Data Link Data Link

SAP
SAP

Event
Action
PA_LM
PA_LM

SAP
SAP
632
633 Figure 7.5 — Logical Unit Reset
634 7.1.5 Other Resets
635 In addition to the direct ways to initiate UFS device reset there are some indirect methods existing also.
636 For example, an UniPro Warm Reset (see [MIPI-UniPro]) is an indirect cause for an UFS device reset.
637 Host System resets its own UniPro stack: UniPro Stack reset activity in host system side also UniPro
638 Stack reset in the UFS Device side via the DME_LINKLOST.ind message. In case UFS device will
639 receive such DME_LINKLOST.ind message from host system it shall start process of re-initializing its
640 own UniPro stack. In addition also all UFS device level activity has been aborted, task queue lists in all
641 logical units shall be cleared and UFS power mode shall return to Sleep mode or Active mode depending
642 on bInitPowerMode.
Page 32
643 7.1.6 Summary of Resets and Device Behavior

644 Table 7.2 and Table 7.3 summarize the different types of reset and the UFS device behavior related to
645 them.
646 Table 7.2 — Reset States
Power Mode after Reset
Current Boot
Reset Type Initiator (2)
Power Mode bInitPowerMode bInitPowerMode Process
= 00h = 01h
(1)
Power-on Host Any Sleep Active Enabled
(1)
HW Reset Host Any Sleep Active Enabled
(1)
EndPointReset Host Any Sleep Active Enabled
Active Maintain the current Maintain the current

LU Reset Host Disabled
or Idle power mode power mode
Host UniPro (1)

Host Any Sleep Active Enabled
Warm Reset
NOTE 1 At the end of the device initialization, the power mode transitions from Active to Pre-Sleep and then
Sleep (after an implementation specific time).
NOTE 2 The column “Boot process” shows after which type of reset the system can execute the boot process as
described in 13.1 “UFS Boot”. The boot process is enabled if the reset event restores the UFS device to the default
state: all parameters are set to the default value, queue are empty, etc.
647
648 Table 7.3 — UniPro Attributes and Descriptor Reset
Volatile and
UniPro Stack Power on reset
Set Only
Reset Type and Attributes Logical Unit Queue
Attributes (1)
Attributes (1) and Flags
and Flags
Reset
Power-on Reset Reset Reset
(all logical units)
Reset
HW Reset Reset Reset Reset
(all logical units)
Reset
EndPointReset Reset Reset Not affected
(all logical units)
Reset
LU Reset Not affected Not affected Not affected
(addressed logical unit)
Host UniPro Reset
Reset Reset No affected
Warm Reset (all logical units)
NOTE 1 See Table 14.18 and Table 14.20 for the definition of Flags and Attributes write access properties.
NOTE 2 Values of Attributes and Flags with “Write once” or “Persistent” access property are kept after power
cycle or any type of reset event.
649
Page 33
650 7.2 Power up ramp

651 During power up, VCC and VCCQ2 should be applied as described in the following.
652  Ta is the point where VCCQ or VCCQ2 power supply first reaches 300 mV.
653  After Ta is reached, VCCQ2 must be greater than VCCQ - 200 mV.
654  VCC can be ramped up independently from VCCQ value or VCCQ2 value.
655  While powering on the device,
656 o RST_n signal should be kept low
657 o REF_CLK signal should be between VSS and VCCQ.
658 Figure 7.6 shows three power up ramp examples: case A and case B meet the specification requirement,
659 while case C violates it in the time interval from Ta to Tb (VCCQ2 is lower VCCQ - 200 mV).
Case A Case B Case C
VCC VCC VCC
3V 3V 3V
VCCQ2 VCCQ2 VCCQ2

1.8V 1.8V 1.8V
1.2V 1.2V 1.2V

VCCQ VCCQ VCCQ
0.3V 0.3V 0.3V
Ta t Ta t Ta Tb t
VCCQ2 is too low
between Ta and Tb
660
661 NOTE 1 The green band represents the voltage range between VCCQ-200mV and VCCQ.
662 Figure 7.6 — Power up ramps

663
664
Page 34
665 7.3 Power off ramp

666 During power off, VCC and VCCQ2 should be removed as described in the following.
667  Tx is the point where VCCQ or VCCQ2 power supply decreases under its minimum operating
668 condition value specified (see Table 6.3).
669  Tz is the point where VCCQ and VCCQ2 power supplies are below 300 mV.
670  VCCQ2 shall be greater than VCCQ - 200 mV between Tx and Tz.
671  VCC can be ramped down independently from VCCQ value or VCCQ2 value.
672  While powering off the device, RST_n signal and REF_CLK signal should be between VSS and
673 VCCQ.
674 Figure 7.7 shows three power down ramp examples: case A and case B meet the specification
675 requirement, while case C violates it in the time interval from Tb to Tz.
Case A Case B Case C
VCC VCC VCC

3V 3V 3V
VCCQ2 VCCQ2 VCCQ2

1.8V 1.8V 1.8V
1.2V VCCQ 1.2V VCCQ VCCQ

1.2V
0.3V 0.3V 0.3V
Tx Tz t Tx Tz t Tx Tb Tz t
VCCQ2 is too low
676 between Tb and Tz
677 NOTE 1 The green band represents the voltage range between VCCQ-200mV and VCCQ.
678 Figure 7.7 — Power off ramps

679
680 The requirements described in this paragraph may not be met only in case of a sudden power off event.
681 Uncontrolled power off should be avoided.
682 A violation of the power off ramp requirement should not result in any corruption of stored data.
683
Page 35
684 7.4 UFS Device Power Modes and LU Power Condition

685 7.4.1 Device Power Modes
686 The device supports multiple power modes, which are controlled by the START STOP UNIT command
687 and some attributes. The device power mode is independent of the bus state of the upstream or
688 downstream links, which are controlled independently.
689 In order to minimize power consumption in a variety of operating environments, UFS devices will
690 support four basic power modes. One where the device is working, one where it is awaiting the next
691 instruction, one where it has been put to sleep until the host wants it, and a final mode where it can be
692 turned off completely. These four power modes will cover the need for the host to control the power
693 consumed by the device, while still maintaining appropriate responsiveness from the device. There are
694 also three transitional modes needed to facilitate the change from one mode to the next.
695 While in active mode processing instructions, there are several possible power scenarios. UFS devices
696 can be expected to be battery powered. However, they may be plugged directly into a power source to
697 recharge those batteries. During those times, a larger current may be available, and large amounts of data
698 may be processed at the same time. There is also the possibility that the device is attached to a mobile
699 device with a failing battery, in which case minimal power consumption is a requirement. Finally, there
700 is the possibility that the host would know nothing of the device with which it is paired, and the device
701 would need to be configured to operate within the host’s current requirements.
702 In order to support these varied scenarios, UFS can support up to sixteen active configurations, each with
703 its own current profile. The host can choose from either pre-defined or user-defined current profiles to
704 deliver the highest performance possible. The following seven power modes are defined: Active, Idle,
705 Pre-Active, UFS-Sleep, Pre-Sleep, UFS-PowerDown, Pre-PowerDown. The details of the system are
706 described in the following sections.
707 7.4.1.1 Active Power Mode
708 In the Active power mode, the device is responding to a command or performing a background operation.
709 In general, the host link may be in either STALL or HS-BURST state (if in high-speed operation), or
710 SLEEP or PWM-BURST (if in low-speed operation).
711 The maximum power consumption in Active is determined by the bActiveICCLevel attribute, and there
712 are sixteen different current consumption levels. The maximum current consumption associated with each
713 level for the three power supplies is described in the Power Parameters Descriptor by:
714  wActiveICCLevelsVCC[15:0] parameter for VCC,
715  wActiveICCLevelsVCCQ[15:0] parameter for VCCQ,
716  wActiveICCLevelsVCCQ2[15:0] parameter for VCCQ2.
717 For example, when the bActiveICCLevel attribute is set to N, the maximum current consumed on VCC is
718 specified by wActiveICCLevelsVCC[N], the maximum current consumed on VCCQ is specified by
719 wActiveICCLevelsVCCQ[N], and the maximum current consumed on VCCQ2 is specified by
720 wActiveICCLevelsVCCQ2[N].
721 The assumption is that the current consumption levels are ordered in terms of performance: that is, that
722 level 0 is lower performance than level 1, which is lower than level 2, and so on until level 15 which
723 corresponds to the highest performance. The host can then read current consumption values associated
724 with each level in the Power Parameters descriptor, and choose the highest performance levels which fits
725 within its current limitations on each power supply.
726 Valid values for the bActiveICCLevel are from “00h” to “0Fh”, other values are reserved and should not
727 be set.
Page 36
728 7.4.1.1 Active Power Mode (cont’d)

729 The maximum combined current consumption on all power supplies for bActiveICCLevel equal to zero is
730 50 mA. Embedded devices should primarily use settings of “06h” and “0Ch”, for normal (battery) and
731 high (plugged in) power operating modes. See vendor datasheet for the maximum current consumption
732 for: those two Active ICC levels, for the Sleep power mode and the PowerDown power mode. Removable
733 devices shall (and embedded devices may) support any of the other setting values.
734 The bInitActiveICCLevel parameter in the Device Descriptor allows the user to configure the Active ICC
735 level after power on or reset.
736 The bInitPowerMode parameter in the Device Descriptor defines the power mode to which the device
737 shall transition to after completing the initialization phase (fDeviceInit cleared to zero).
738 Active Mode can be entered from the Powered On mode or the Pre-Active mode after the completion of
739 all setup necessary to handle commands.
740 The following power mode may be: Idle, Pre-Sleep, or Pre-PowerDown.
741 All supported commands are available in Active Mode.
742 7.4.1.2 Idle Power Mode
743 The Idle power mode is reached when the device is not executing any operation. In general, the host link
744 may be in either STALL or SLEEP state. If background operations are continuing, the device should be
745 considered Active power mode.
746 This mode can only be entered from an Active power mode, and the following state is always the Active
747 power mode. The receipt of any command will transition the device into Active power mode.
748 7.4.1.3 Pre-Active Power Mode
749 The Pre-Active power mode is a transitional mode associated with Active power mode. The power
750 consumed will be no more than that consumed in Active power mode. The device shall remain in this
751 power mode until all of the preparation needed to accept commands has been completed.
752 Pre-Active power mode can be entered from Pre-Sleep, Sleep, Pre-PowerDown, or PowerDown. The
753 following power mode is the Active power mode.
754 While in Pre-Active power mode:
755 a) START STOP UNIT command and REQUEST SENSE command are the only SCSI commands
756 that the device may successfully complete; other commands may be terminated with CHECK
757 CONDITION status, with the sense key set to NOT READY, with the additional sense code set to
758 LOGICAL UNIT IS IN PROCESS OF BECOMING READY. See 7.4.1.9 for further details.
759 b) a REQUEST SENSE command shall terminated with GOOD status and provide pollable sense
760 data with the sense key set to NO SENSE, and the additional sense code set to LOGICAL UNIT
761 TRANSITIONING TO ANOTHER POWER CONDITION.
762
Page 37
763 7.4.1.4 UFS-Sleep Power Mode

764 The UFS-Sleep power mode allows to reduce considerably the power consumption of the device.
765 VCC power supply can be removed in this state.
766 The UFS-Sleep power mode is entered from Pre-Sleep power mode.
767 While in UFS-Sleep power mode:
770 CONDITION status, with the sense key set to ILLEGAL REQUEST. See 7.4.1.9 for further
771 details.
772 b) a REQUEST SENSE command shall be terminated with GOOD status and provide pollable sense
773 data with the sense key set to NOT READY and the additional sense code set to LOGICAL
774 UNIT NOT READY, INITIALIZING COMMAND REQUIRED.
775 It is recommended to put the link in HIBERN8 state, although it is actually under host control and can
776 come up and down independently of the UFS power mode.
777 VCC power supply should be restored before issuing START STOP UNIT command to request transition
778 to Active power mode or PowerDown power mode.
779 7.4.1.5 Pre-Sleep Power Mode
780 The Pre-Sleep Mode is a transitional mode associated with UFS-Sleep entry. The power consumed will
781 be no more than that consumed in Active power mode. Pre-Sleep can be entered from Active power
782 mode.
783 The device will automatically advance to Sleep power mode once any outstanding operations and
784 management activities have been completed.
785 The device will transition from Pre-Sleep power mode to Pre-Active power mode if START STOP UNIT
786 command with POWER CONDITION = 1h is issued.
787 While in Pre-Sleep power mode:
791 details.
794 UNIT TRANSITIONING TO ANOTHER POWER CONDITION
795 c) SCSI Task management functions shall operate normally.
796
Page 38
797 7.4.1.6 UFS-PowerDown Power Mode

798 The UFS-PowerDown power mode is the maximum power saving mode. All volatile data may be lost,
799 and all power supplies can be removed.
800 This mode is automatically entered from the Pre-PowerDown power mode, at the completion of the
801 power mode transition.
802 While in UFS-Power Down power mode:
805 CONDITION status, with the sense key set to NOT READY and the additional sense code set to
806 LOGICAL UNIT NOT READY, INITIALIZING COMMAND REQUIRED. See 7.4.1.9 for
807 further details.
808 b) REQUEST SENSE command shall be terminated with GOOD status and provide pollable sense
809 data with the sense key set to NOT READY, and the additional sense code set to LOGICAL
810 UNIT NOT READY, INITIALIZING COMMAND REQUIRED.
811 7.4.1.7 Pre-PowerDown Power Mode
812 The Pre-PowerDown power mode is a transitional mode associated with UFS-PowerDown entry. The
813 power consumed will be no more than that consumed in Active power mode. Pre-PowerDown can be
814 entered from Active or Sleep.
815 The device will automatically advance to PowerDown power mode once any outstanding operations and
816 management activities have been completed.
817 The device will transition to Pre-Active mode if START STOP UNIT command with POWER
818 CONDITION field set to 1h is issued.
819 The following power mode may be PowerDown or Pre-Active.
820 While in Pre-Power Down power mode:
824 details.
827 UNIT TRANSITIONING TO ANOTHER POWER CONDITION.
828 c) SCSI Task management functions shall operate normally.
829
Page 39
830 7.4.1.8 Power Mode State Machine

831 The relationship amongst the different power modes is shown in the following diagram.
Powered On
Sleep Pre-Sleep
SSU,
SSU,
PC=2
PC=1 (1)
bInitPowerMode
= 00h (3)
SSU,
PC=1
Pre-Active Active Idle
SSU,
PC=1
SSU,
PC=1 (2) SSU
PC=3
PowerDown
SSU,
PC=3 Pre-PowerDown
(1) This transition may occur only if the SSU command that caused the transition to Pre-Sleep had
IMMED set to one.
(2) This transition may occur only if the SSU command that caused the transition to Pre-PowerDown had
IMMED set to one.
(3) This automatic transition shall occur at the end of device initialization if bInitPowerMode = 00h.
832
833 Figure 7.8 — Power Mode State Machine
834
835 7.4.1.8.1 Transitions from Powered On Power Mode
836 The device shall enter in Powered On when: the power supplies are applied, after hardware reset,
837 EndPointReset or Host System UniPro Reset.
838 Transition from Powered_On to Active
839 This transition shall occur when the device is ready to begin power on initialization.
840 7.4.1.8.2 Transitions from Pre‐Active Power Mode
841 Transition from Pre-Active to Active
842 This transition shall occur when the device meets the requirements for being in Active power mode.
843
Page 40
844 7.4.1.8.3 Transitions from Active Power Mode

845 Transition from Active to Idle
846 This transition may occur when the device completes any ongoing operations.
847 Transition from Active to Pre-Sleep
848 This transition shall occur
849  at the end of the device initialization and if the bInitPowerMode parameter is set to "00h”, or
850  if the device server processes a START STOP UNIT command with the POWER CONDITION field
851 set to 2h.
852 Transition from Active to Pre-PowerDown
853 This transition shall occur if the device server processes a START STOP UNIT command with the
854 POWER CONDITION field set to 3h.
855 7.4.1.8.4 Transitions from Idle Power Mode
856 Transition from Idle to Active
857 This transition shall occur if the device processes a request that requires to be in Active power mode.
858 7.4.1.8.5 Transitions from Pre‐Sleep Power Mode
859 Transition from Pre-Sleep to Pre-Active
860 This transition shall occur if the START STOP UNIT command that caused the transition to Pre-Sleep
861 power mode had IMMED set to one, and when the device server processes a START STOP UNIT
862 command with the POWER CONDITION field set to 1h.
863 Transition from Pre-Sleep to Sleep
864 This transition shall occur when the device meets the requirements for being in Sleep power mode.
865 7.4.1.8.6 Transitions from UFS‐Sleep Power Mode
866 Transition from UFS-Sleep to Pre-Active
869 Transition from UFS-Sleep to Pre-PowerDown
872 7.4.1.8.7 Transitions from Pre‐PowerDown Power Mode
873 Transition from Pre-PowerDown to Pre-Active
874 This transition shall occur if the START STOP UNIT command that caused the transition to Pre-
875 PowerDown power mode had IMMED set to one, and when the device server processes a START STOP
876 UNIT command with the POWER CONDITION field set to 1h.
877 Transition from Pre-PowerDown to PowerDown
878 This transition shall occur when the device meets the requirements for being in Pre-PowerDown power
879 mode.
Page 41
880 7.4.1.8.8 Transitions from UFS‐PowerDown Power Mode

881 Transition from UFS-PowerDown to Pre-Active
884 7.4.1.8.9 SCSI command and UPIU transactions
885 The current power mode may be retrieved reading the bCurrentPowerMode attribute.
886 bCurrentPowerMode is the only attribute the device is required to return in any power mode. If the device
887 is not in Active power mode or Idle power mode, a QUERY REQUEST UPIU to access descriptors,
888 flags, or attributes rather than bCurrentPowerMode may fail.
889 By setting the IMMED bit to one during the START STOP UNIT command, the device can be instructed
890 to respond at the entrance to the transitional mode, once the command is received.
891 The effects of concurrent power mode changes requested by START STOP UNIT commands with the
892 IMMED bit set to one are vendor specific.
893 A START STOP UNIT command with the IMMED bit set to zero causing a transition to Active, Sleep,
894 or PowerDown power modes shall not complete with GOOD status until the device reaches the power
895 mode specified by the command.
896 Table 7.4 summarizes which SCSI commands and UPIU transactions are allowed for each power mode.
897 Table 7.4 — Allowed SCSI commands and UPIU for each Power Mode
Power Mode SCSI Commands UPIU Transactions
Active Any commands Any UPIU
Idle Any commands Any UPIU
COMMAND UPIU
RESPONSE UPIU
START STOP UNIT REJECT UPIU
Pre-Active
REQUEST SENSE DATA IN UPIU
QUERY REQUEST UPIU
QUERY RESPONSE UPIU
COMMAND UPIU
RESPONSE UPIU
UFS-Sleep
QUERY REQUEST UPIU
QUERY RESPONSE UPIU
COMMAND UPIU
RESPONSE UPIU
START STOP UNIT
REJECT UPIU
Pre-Sleep REQUEST SENSE
DATA IN UPIU
Task Managem. Fun.
QUERY REQ./RESPONSE UPIU
TASK MANAG. REQ./RESPONSE UPIU
COMMAND UPIU
RESPONSE UPIU
UFS-PowerDown
QUERY REQUEST UPIU
QUERY RESPONSE UPIU
COMMAND UPIU
RESPONSE UPIU
START STOP UNIT
REJECT UPIU
Pre-PowerDown REQUEST SENSE
DATA IN UPIU
Task Managem. Fun.
QUERY REQ./RESPONSE UPIU
TASK MANAG. REQ./RESPONSE UPIU
Page 42
898 7.4.1.9 Device Well Know Logical Unit Responses to SCSI commands
899 Table 7.5 defines the Device well known logical unit response to a START STOP UNIT command with
900 IMMED bit set to zero for various device power modes.
901 Table 7.5 — Device Well Known Logical Unit Responses to SSU command
Power Mode PC STATUS SENSE KEY ASC, ASCQ
(1)
1h GOOD - -
Pre-Active CHECK LOGICAL UNIT NOT READY, START
Others NOT READY
CONDITION STOP UNIT COMMAND IN PROGRESS
(1)
1h, 2h, 3h GOOD - -
Active CHECK ILLEGAL
Others INVALID FIELD IN CDB
CONDITION REQUEST
(1)
2h GOOD - -
Pre-Sleep CHECK LOGICAL UNIT NOT READY, START
Others NOT READY
(1)
1h, 2h, 3h GOOD - -
UFS-Sleep CHECK ILLEGAL
CONDITION REQUEST
(1)
3h GOOD - -
Pre-PowerDown CHECK LOGICAL UNIT NOT READY, START
Others NOT READY
(1)
1h, 3h GOOD - -
UFS-PowerDown CHECK ILLEGAL
CONDITION REQUEST
NOTE 1 The START STOP UNIT command may not terminate with GOOD status for condition not due to
CDB content.
902 Table 7.6 summarizes the response that the Device well known logical unit may provide to a command
903 other than START STOP UNIT for various device power modes.
904
Page 43
905 7.4.1.9 Device Well Know Logical Unit Responses to SCSI commands (cont’d)
906 Table 7.6 — Device Well Known Logical Unit Responses to commands other than SSU
Power Mode Command STATUS SENSE KEY ASC, ASCQ
REQUEST
GOOD (1) - -
SENSE
Pre-Active
CHECK LOGICAL UNIT IS IN PROCESS OF
Others (1) NOT READY
CONDITION BECOMING READY
REQUEST
GOOD (1) - -
SENSE
Pre-Sleep,
Pre-PowerDown. CHECK ILLEGAL
Others (1) -
CONDITION REQUEST
REQUEST
GOOD (1) - -
UFS-Sleep, SENSE
UFS-PowerDown CHECK LOGICAL UNIT NOT READY,
Others (1) NOT READY
CONDITION INITIALIZING COMMAND REQUIRED
NOTE 1 Rows identified with “Others” define Device well known logical unit response to command other than START STOP
UNIT command and REQUEST SENSE command.
907 Table 7.7 defines the pollable sense data for various device power modes.
908 Table 7.7 — Pollable Sense Data for each Power Modes
Power Mode SENSE KEY ASC, ASCQ
Pre-Active,
LOGICAL UNIT TRANSITIONING TO
Pre-Sleep, NO SENSE
ANOTHER POWER CONDITION
Pre-PowerDown
UFS-PowerDown, LOGICAL UNIT NOT READY,
NOT READY
UFS-Sleep INITIALIZING COMMAND REQUIRED
909 7.4.2 Power Management Command: START STOP UNIT

910 When the START STOP UNIT command is sent to a logical unit, it can be used to enable or disable that
911 logical unit, flush all cached logical blocks to the medium (for logical units that contain cache), or load or
912 eject the medium.
913 When the START STOP UNIT command is sent to the UFS Device well-known logical unit (W-LUN =
914 50h), it can be used to select the device power mode.
915 Table 7.8 — START STOP UNIT command
Bit
7 6 5 4 3 2 1 0
Byte
0 OPERATION CODE (1Bh)
1 Reserved IMMED
2 Reserved
POWER CONDITION MODIFIER
3 Reserved
(Reserved = 0000b)
NO_FLU LOEJ
4 POWER CONDITION Reserved START
SH = 0b
5 CONTROL (00h)
Page 44
916 7.4.2 Power Management Command: START STOP UNIT (cont’d)

917 The POWER CONDITION field selects the desired mode. If the command is sent to a logical unit other
918 than the Device well known logical unit, the POWER CONDITION field may be ignored.
919 Table 7.9 — START STOP UNIT fields
LUN or WLUN
No Power
IMMED Start LUN Field Action
Flush Condition
in UPIU
0 - - - - Response is sent after change is complete.
Response is sent immediately after command

1 - - - -
decode
Dynamic data should be flushed to non-volatile

- 0 - - -
storage
- 1 - - - No requirements regarding dynamic data
0h to 7h
- - 0h 0 Stop the designated LU.
0h to 7h
0h to 7h
- - 0h 1 Start the designated LU.
0h to 7h
50h
- - 1h 0 Cause a transition to the Active power mode
D0h
50h Cause a transition to the UFS-Sleep power
- - 2h 0
D0h mode
50h Cause a transition to the UFS-PowerDown

- - 3h 0
D0h power mode
920
921
Page 45
922 7.4.3 Power Mode Control

923 Table 7.10 defines a series of attributes used to control the active current levels and power modes.
924 Table 7.10 — Attribute for Power Mode Control
Attribute Name Size Type Description
Current device Power Mode Status

00h: Idle mode
10h: Pre-Active mode
11h: Active mode
bCurrentPowerMode 1 Byte Read only 20h: Pre-Sleep mode
22h: UFS-Sleep mode
30h: Pre-PowerDown mode
33h: UFS-PowerDown mode
Others: Reserved
bActiveICCLevel defines the maximum current

consumption allowed during Active mode.
Read / 00h: Lowest Active ICC level

bActiveICCLevel 1 Byte …
Write 0Fh: Highest Active ICC level
Others: Reserved
Valid range from 00h to 0Fh.
925 Table 7.11 shows the Device Descriptor parameters that allow to define the power mode and the Active
926 ICC level after power on or reset. These parameters shall be configured during system integration.
927 Table 7.11 — Device Descriptor parameters
Parameter Name Size Description
Initial Active ICC Level

bInitActiveICCLevel defines the bActiveICCLevel
bInitActiveICCLevel 1 Byte
value after power on or reset.
Initial Power Mode

bInitPowerMode defines the Power Mode after device
initialization or hardware reset
bInitPowerMode 1 Byte
00h: UFS-Sleep Mode
01h: Active Mode
Others: Reserved
928
Page 46
929 7.4.3 Power Mode ontrol (cont’d)

930 Table 7.12 defines the parameters of the Power Parameters Descriptor. Each parameter is composed by
931 sixteen elements, the size of each element is two bytes, and it is structured as shown in Table 7.13.
932
933 Table 7.12 — Power Parameters Descriptor fields
Parameter Name Size Type Description
Active ICC Levels for VCC

Read Maximum peak current consumed from VCC in
wActiveICCLevelsVCC[15:0] 32 Byte
Only each of the sixteen current consumption levels
defined for the Active mode.
Active ICC Levels for VCCQ

Read Maximum peak current consumed from VCCQ in
wActiveICCLevelsVCCQ [15:0] 32 Bytes
Only each of the sixteen current consumption levels
Active ICC Levels for VCCQ2

Read Maximum peak current consumed from VCCQ2
wActiveICCLevelsVCCQ2 [15:0] 32 Bytes
Only in each of the sixteen current consumption levels
934
935 Table 7.13 — Format for Power Parameter element
Field Name Bit Range Description
00b:nA
01b:uA
Unit bit [15:14]
10b:mA
11b: A
- bit [13:10] Reserved (0000b)
The maximum current expected in

Value bit [9: 0]
each current consumption level
936
937
Page 47
938 7.4.4 Logical Unit Power Condition

939 Each logical unit may be in active power condition and stopped power condition. See [SPC] and [SBC]
940 for the definition of these two logical unit power conditions.
941 All logical units shall be in the active power condition after power on or any type of reset event.
942 Transition from active power condition to stopped power condition shall occur if the device server
943 processes a START STOP UNIT command with the START bit set to zero and the POWER
944 CONDITION field set to 0h.
945 Transition from stopped power condition to active power condition shall occur if the device server
946 processes a START STOP UNIT command with the START bit set to one and the POWER
947 CONDITION field set to 0h.
948 START STOP UNIT command to change the logical unit power condition should be issued only if the
949 device is in Active power mode or Idle power mode.
950 A transition in the device power mode state shall not change the logical unit power condition.
951 Table 7.14 defines the logical unit responses to SCSI commands for various device power modes
952
953 Table 7.14 — Logical Unit Response to SCSI command
Power Mode COMMAND STATUS SENSE KEY ASC, ASCQ
Pre-Active,
Pre-Sleep,
CHECK NOT
UFS-Sleep Any -
CONDITION READY
Pre-PowerDown
UFS-PowerDown
954
955 If the logical unit is in the stopped power condition, then the device server shall
956  provide pollable sense data with sense key set to NOT READY and the additional sense code set
957 to LOGICAL UNIT NOT READY, INITIALIZING COMMAND REQUIRED;
958  terminate each media access command or TEST UNIT READY command with CHECK
959 CONDITION status with the sense key set to NOT READY and the additional sense code set to
960 LOGICAL UNIT NOT READY, INITIALIZING COMMAND REQUIRED.
Page 48
961 8 UFS UIC LAYER: MIPI M-PHY
962 8.1 Termination

963 The M‐TX shall be terminated as defined in section “Termination Scheme” of the M‐PHY specification
964 [MIPI-M-PHY].
965 The M‐RX shall include switchable differential termination. By default the M‐RX termination shall be off
966 in PWM‐BURST state and may be turned setting the proper MIPI Attribute. The termination shall be on
967 by default in HS‐BURST state and may be turned off. There shall be no termination in SLEEP and
968 STALL states. During DISABLE and HIBERNATE states M‐TX drives High‐Z while M‐RX terminates
969 the lane by a 'Dif‐Z keeper'. Dif‐Z keeper means M‐RX drives a weak differential zero on the lane.
970
RSE_TX RDIFF_RX/2
LINE amplifier
VLD
RSE_TX RDIFF_RX/2
971
972 Figure 8.1 — Simplified example for I/O termination
973 M‐RX of a SUBLINK in a LINK may have different termination settings.
974 The supported termination settings are defined in the Capability Attributes in Table 8.1 and Table 8.2.
975 The termination is controlled via the Configuration Attributes. The receiver termination resistance is
976 defined in the M‐PHY Specification.
977 Timings of the termination enable and disable are defined in the M‐PHY Specification.
978 8.2 Drive Levels
979 The M-PHY Specification defines two different drive amplitudes: the large amplitude (LA) and the small
980 amplitude (SA). The UFS IF utilizes both of these drive amplitudes as defined in the M-PHY
981 Specification.
982 Every M-TX in every LINK will start communication with LA after power up or reset. Option to switch
983 to SA mode shall be supported via a Configuration Attribute.
984 SUBLINKS in a LINK shall communicate with same amplitude.
985 8.3 PHY State machine
986 The UFS IF shall implement the Type I state machine.
987 The M‐PHY Specification defines two different signaling schemes for low‐speed (LS) mode: Non‐
988 Return-to‐Zero (NRZ) and Pulse‐Width‐Modulation (PWM). The UFS IF shall utilize the PWM signaling
989 scheme in the LS mode as defined by the M‐PHY specification for the State Machine Type I [MIPI M-
990 PHY ].
991 The UFS IF shall implement both Mode‐LCC and Configuration‐LCC line control commands as defined
992 in the M‐PHY Specification for the state machine Type I.
Page 49
993 8.4 HS Burst

994 A UFS device shall support the HS‐GEAR1 and the HS‐GEAR2. Support for HS‐GEAR3 is optional. The
995 supported gears are indicated in the Capability Attribute Table 8.1 and Table 8.2.
996 SUBLINKS in a LINK may communicate with different HS‐GEAR or PWM‐GEAR.
997 8.4.1 HS Prepare Length Control
998 The TX_HS_PREPARE_LENGTH M-PHY configuration attribute defines the time to move from
999 STALL to HS‐BURST. At reset M‐TX settles the TX_HS_PREPARE_LENGTH = 15.
1000 8.4.2 HS Sync Length Control
1001 The TX_HS_SYNC_LENGTH M-PHY configuration attribute defines the number of synchronization
1002 symbols before a HS Burst. In the UFS interface the synchronization sequence shall be generated by the
1003 M‐TX. Support for protocol controlled synchronization is optional. M‐TX starts at reset with
1004 TX_HS_SYNC_LENGTH = 15, in COARSE type.
1005 8.4.3 Slew Rate Control
1006 A UFS Device may include configurable Slew Rate control as per the M‐PHY Specification. If the Slew
1007 Rate Control is supported by a UFS Device then the number of N (steps) shall be 4 ≤ N ≤ 8.
1008 8.5 PWM Burst
1009 A UFS device shall support the PWM‐G1 (default, mandated by [M‐PHY]), PWM‐G2, PWM‐G3 and
1010 PWM‐G4 GEARS. The PWM‐G5, PWM‐G6 and PWM‐G7 are optional. The supported PWM‐GEARS
1011 are indicated in the Capability Attributes Table 8.1 and Table 8.2.
1012 NOTE Even if the physical layer supports PWM-G0, this gear can not be used because it is not supported by
1013 [MIPI-UniPro].
1014 The PWM‐G1 shall be the active one by default after power up or reset.
1015 SUBLINKS in a LINK may communicate with different PWM‐GEAR or HS‐GEAR.
1016 8.5.1 LS Prepare Length Control
1017 The TX_LS_PREPARE_LENGTH M-PHY configuration attribute defines the time to move from SLEEP
1018 to PWM‐BURST. At reset M‐TX settles the TX_LS_PREPARE_LENGTH = 10.
1019 8.6 UFS PHY Attributes
1020 The MIPI M‐PHY includes several configurable attributes. There is range of values defined for the
1021 attributes but it is left for the application to fix the actual required values inside the range. Following is
1022 the list of such attributes. The UFS application specific requirement for the values can be found from
1023 Table 8.1 and Table 8.2.
1024
Page 50
1025 8.6 UFS PHY Attributes (cont’d)

1026 Table 8.1 — UFS PHY M-TX Capability Attributes
Attribute UFS
Attribute Name Range Notes
ID Value
False = 0,
TX_HSMODE_Capability 0x01 1
True = 1
HS_G1_ONLY = 1,
TX_HSGEAR_Capability 0x02 HS_G1_TO_G2 = 2, ≥2 1
HS_G1_TO_G3 = 3
TX_PWMG0_Capability 0x03 0=No, 1=Yes 0, 1 2
PWM_G1_ONLY = 1,
PWM_G1_TO_G2 = 2,
PWM_G1_TO_G3 = 3,
TX_PWMGEAR_Capability 0x04 PWM_G1_TO_G4 = 4, ≥4 3
PWM_G1_TO_G5 = 5,
PWM_G1_TO_G6 = 6,
PWM_G1_TO_G7 = 7
TX_Amplitude_Capability 0x05 SA=1, LA=2, Both=3 3 4
0=False
TX_ExternalSYNC_Capability 0x06 0, 1 5
1=True
TX_HS_Unterminated_LINE_Drive_Capability 0x07 0=No, 1=Yes 1 6
TX_LS_Terminated_LINE_Drive_Capability 0x08 0=No, 1=Yes 1 6
TX_Min_SLEEP_NoConfig_Time_Capability 0x09 1 to 15 1 to 15
TX_Min_STALL_NoConfig_Time_Capability 0x0A 1 to 250 1 to 15
TX_Min_SAVE_Config_Time_Capability 0x0B 1 to 250 1 to 250 7
TX_REF_CLOCK_SHARED_Capability 0x0C 0=No, 1=Yes 1
B[7:4] : Major version
0 to 9 8
number
TX_PHY_MajorMinor_Release_Capability 0x0D
B[3:0] : Minor version
0 to 9 8
number
TX_PHY_Editorial_Release_Capability 0x0E B[7:0] = 1 to 99 1 to 99 8
TX_Hibern8Time_Capability 0x0F 1 to 128 1 9
B[2:1] =
B[2:1]: Step size
0 to 3
TX_Advanced_Granularity_Capability 0x10 B[0]: Supports fine
B[0] =
granularity steps
0,1
TX_Advanced_Hibern8Time_Capability 0x11 1 to 128 1 to 128
B[1:0] =
TX_HS_Equalizer_Setting_Capability 0x12 B[1:0]
0 to 3
NOTE 1 All HS gears from HS-GEAR1 to TX_HSGEAR_Capability shall be supported.
NOTE 2 Even if TX_PWMG0_Capability = 1, PWM-G0 cannot be used because it is not supported by [MIPI-
UniPro].
NOTE 3 All PWM gears from PWM-GEAR1 to TX_PWMGEAR_Capability shall be supported.
NOTE 4 UFS device shall support both drive levels.
NOTE 5 Support for external SYNC pattern is optional and its definition is device specific.
NOTE 6 A UFS device shall support un-terminated HS burst and terminated LS burst.
NOTE 7 Minimum reconfiguration time (in 40 ns steps).
NOTE 8 See clause 2 “Normative Reference”.
NOTE 9 Time defined in 0.1msec steps.
Page 51

1028 Table 8.2 — UFS PHY M-RX Capability Attributes
Attribute Name Attribute ID Range UFS Value Notes
RX_HSMODE_Capability 0x81 No=0, Yes=1 1
HS_G1_ONLY = 1,
RX_HSGEAR_Capability 0x82 HS_G1_TO_G2 = 2, ≥2 1
HS_G1_TO_G3 = 3
RX_PWMG0_Capability 0x83 0=No, 1=Yes 0, 1 2
PWM_G1_ONLY = 1,
PWM_G1_TO_G2 = 2,
PWM_G1_TO_G3 = 3,
RX_PWMGEAR_Capability 0x84 PWM_G1_TO_G4 = 4, ≥4 3
PWM_G1_TO_G5 = 5,
PWM_G1_TO_G6 = 6,
PWM_G1_TO_G7 = 7
RX_HS_Unterminated_Capability 0x85 0=No, 1=Yes 1 4
RX_LS_Terminated_Capability 0x86 0=No, 1=Yes 1 4
RX_Min_SLEEP_NoConfig_Time_Capability 0x87 1 to 15 1 to 15
RX_Min_STALL_NoConfig_Time_Capability 0x88 1 to 255 1 to 15
RX_Min_SAVE_Config_Time_Capability 0x89 1 to 250 1 to 250 5
RX_REF_CLOCK_SHARED_Capability 0x8A 0=No, 1=Yes 1
B[5:0] ≤ 15 if
B[7:6] : SYNC_range
B[7:6] = 0,
FINE = 0, COARSE = 1
RX_HS_G1_SYNC_LENGTH_Capability 0x8B or
B[5:0] : SYNC_length
B[5:0] ≤ 8 if
0 to 15
B[7:6] = 1
RX_HS_G1_PREPARE_LENGTH_Capability 0x8C 0 to 15 0 to 15
RX_LS_PREPARE_LENGTH_Capability 0x8D 0 to 15 0 to 15
RX_PWM_Burst_Closure_Length_Capability 0x8E 0 to 31 0 to 31
RX_Min_ActivateTime_Capability 0x8F 1 to 9 1 to 9 6
B[7:4] : Major version
0 to 9 7
number
RX_PHY_MajorMinor_Release_Capability 0x90
B[3:0] : Minor
0 to 9 7
version number
RX_PHY_Editorial_Release_Capability 0x91 1 to 99 1 to 99 7
RX_Hibern8Time_Capability 0x92 1 to 128 1 6
B[7:6] : SYNC_range
FINE = 0, COARSE = 1 B[7:6] =1,0
RX_PWM_G6_G7_SYNC_LENGTH_Capability 0x93
B[5:0] : SYNC_length B[5:0] ≤ 15
0 to 15
B[5:0] ≤ 15 if
B[7:6] : SYNC_range
B[7:6] = 0,
FINE = 0, COARSE = 1
RX_HS_G2_SYNC_LENGTH_Capability 0x94 or
B[5:0] ≤ 8 if
0 to 15
B[7:6] = 1
B[5:0] ≤ 15 if
B[7:6] : SYNC_range
B[7:6] = 0,
FINE = 0,COARSE = 1
RX_HS_G3_SYNC_LENGTH_Capability 0x95 or
B[5:0] ≤ 8 if
0 to 15
B[7:6] = 1
RX_HS_G2_PREPARE_LENGTH_Capability 0x96 B[3:0] = 0 to 15 ≤ 15
RX_HS_G3_PREPARE_LENGTH_Capability 0x97 B[3:0] = 0 to 15 ≤ 15
B[2:1]: Step size B[2:1] =
RX_Advanced_Granularity_Capability 0x98 B[0]: Supports fine 0 to 3
granularity steps B[0] =0,1
RX_Advanced_Hibern8Time_Capability 0x99 1 to 128 1 to 128
B[3:0] =
RX_Advanced_Min_ActivateTime_Capability 0x9A B[3:0] = 1 to 14
1 to 14
Page 52

1030 Table 8.3 — UFS PHY M-RX Capability Attributes(cont’d)
NOTE 1 All HS gears from HS-GEAR1 to RX_HSGEAR_Capability shall be supported.
NOTE 2 Even if RX_PWMG0_Capability = 1, PWM-G0 cannot be used because it is not supported by [MIPI-UniPro].
NOTE 3 All PWM gears from PWM-GEAR1 to RX_PWMGEAR_Capability shall be supported.
NOTE 4 A UFS device shall support un-terminated HS burst and terminated LS burst.
NOTE 5 Minimum reconfiguration time in 40ns steps.
NOTE 6 Time defined in 0.1msec steps.
NOTE 7 See clause 2 “Normative Reference”.
1031
1032 8.7 Operation Timings
1033 8.7.1 Reference Clock Timings
1034 The reference clock shall be turned ON before initiation of the state transition to STALL. The clock may
1035 be turned OFF again after both links has reached either HIBERNATE or SLEEP states.
1036
1037 8.8 Electrical characteristics
1038 8.8.1 Transmitter Characteristics
1039 As defined in the M-PHY Specification.
1040 8.8.2 Receiver Characteristics
1041 As defined in the M-PHY Specification.
1042
Page 53
1043 9 UFS UIC LAYER: MIPI UNIPRO
1044 9.1 Overview

1045 UFS builds on the MIPI Unified Protocol (UniPro) as its Interconnect (Service Delivery Subsystem) to
1046 provide basic transfer capabilities to the UFS Transport Protocol (UTP) Layer. On the data plane UTP
1047 and UniPro communicate via the Service Primitives of the UniPro Transport Layer CPorts
1048 (T_CO_SAPs). Control plane interaction (e.g., discovery, enumeration and configuration of the Link)
1049 between higher layer protocol functions of UFS and UniPro are accomplished using the Device
1050 Management Entity Service Primitives as defined by the UniPro specification.
1051 9.2 Architectural Model
1052 UniPro is internally composed of several sub-layers which are all well defined by the MIPI UniPro
1053 specification [MIPI-UniPro]. In the context of UFS the entire UniPro protocol stack shall be viewed as a
1054 black box model (see Figure 9.1) to the greatest extent possible. The following sections therefore only:
1055  Specify number and type of the required interfaces between UFS and UniPro
1056  Specify the mapping between UFS and UniPro addressing scheme
1057  Select optional features and definable attributes of the UniPro specification
Application Protocol Application Protocol

D C C C C D C C C C
M 0 1 2 3 M 0 1 2 3
LM Transport (L4)
LM Network (L3)
DME
LM Data Link (L2)
LM PHY Adapter (L1.5)
PHY Tx PHY Rx
(a) (b)
1058
1059 Figure 9.1 — UniPro internal layering view (a) and UniPro Black Box view (b)
1060
Page 54
1061 9.3 UniPro/UFS Transport Protocol Interface (Data Plane)

1062 UniPro provides CPorts as conceptual interfaces to applications or protocol layers on top of UniPro.
1063 CPorts can be viewed as instantiations of the T_CO_SAPs as specified in 8.8 of the UniPro specification.
1064 The physical implementation of a T_CO_SAP was deliberately not defined in MIPI as implementers
1065 should be free to choose, e.g., a SW implementations of higher UniPro layers, HW implementations based
1066 on buffering per CPort or DMA channels per CPort, etc.
1067 A Service Access Point (SAP) provides Service Primitives (SP) which can be used by specifications of
1068 applications or protocols as UFS on top of UniPro to define their interactions. For more information on
1069 the concept of SAP/SP in protocol specifications please refer to Annex C of the UniPro specification.
1070 The T_CO_SAP provides the following core data transfer service primitives (see UniPro specification,
1071 8.8.1):
1072  T_CO_DATA.req( MessageFragment, EOM)
1073 o Issued by service user of UniPro to send a message (Fragment)
1074 NOTE Whenever a UFS layer requests the UIC layer to transfer data that UFS layer shall ensure that the
1075 last fragment of said data will be transmitted with the EOM flag set. One way to ensure such a behavior is
1076 for the UFS layer to invoke this UIC data transfer service primitive only once per atomic protocol data unit
1077 (e.g., once per UFS Transport Layer ‘UPIU’) with the EOM flag set to ‘true’ always.
1078  T_CO_DATA.cnf_L( L4CPortResultCode )
1079 o Issued by UniPro to report the result of a Message (Fragment) transfer request
1080  T_CO_DATA.ind( MessageFragment, EOM, SOM, MsgStatus )
1081 o Issued by UniPro to deliver a received Message (Fragment) towards the service user
1082 o EOM informs the service user that this is the last Message Fragment (EndOfMessage)
1083 o SOM informs the service user that this is the first Message Fragment (StartOfMessage)
1084  T_CO_DATA.rsp_L( )
1085 o Issued by a service user of UniPro to report readiness to receive the next Message
1086 (Fragment)
1087 Flow control
1088 UFS will not make use of the End-to-End Flow Control feature of UniPro for data communication as the
1089 UFS Transport Layer already avoids any overflow by a strict Host/Client communication model, tagged
1090 command queues and Device side throttling of Data transfers. Therefore UFS will not use the
1091 T_CO_FLOWCONTROL service primitive of UniPro and hence does not require its implementation.
1092 Object sizes
1093 A UniPro Message can be of any size and its content is not interpreted in any way by UniPro. Messages
1094 can be delivered from/to UniPro as multiple Message Fragments.
1095 A Message Fragment is a portion of a Message that can be passed to, or received by, a CPort. Received
1096 Fragments are not generally identical to transmitted Fragments. Message Fragments may or may not carry
1097 an End-of-Message (EoM) flag.
1098 A Message Fragment shall have maximum of T_MTU bytes to avoid further splitting in lower layers.
1099
Page 55
1100 9.4 UniPro/UFS Control Interface (Control Plane)

1101 UniPro provides access to its Device Management Entity (DME) via a Service Access Point (DME SAP)
1102 with the following services exposed to UFS allowing control of properties and the behavior of UniPro:
1103 DME Configuration Primitives
1104  DME_GET / DME_SET
1105 o Provide read/write access to all UniPro and M-PHY attributes of the local UniPort
1106  DME_PEER_GET (optional) / DME_PEER_SET (optional)
1107 o Provide read/write access to all UniPro and M-PHY attributes of the peer UniPort
1108 NOTE The order in which attributes are set is in some cases relevant for UniPro’s correct operation. Therefore
1109 higher UFS layers shall preserve the ordering of DME Configuration Primitives invocations by UFS applications. If
1110 internally generated by UFS itself, DME Configuration Primitives shall be issued correctly ordered as defined by the
1111 UniPro specification.
1112 DME Control Primitives
1113  DME_POWERON (optional) / DME_POWEROFF (optional)
1114 o Allow to power up or power down all UniPro layers (L1.5 through L4)
1115  DME_ENABLE
1116 o Allow enabling of the entire local UniPro stack (UniPro L1.5 -L4)
1117  DME_RESET
1118 o Allows to reset the entire local UniPro stack (UniPro L1.5-L4)
1119  DME_ENDPOINTRESET
1120 o Allows sending an end-point reset request command to a link end point.
1121  DME_LINKSTARTUP
1122 o Allows locally to startup the Link and informs about remote link startup invocation
1123  DME_HIBERNATE_ENTER / DME_HIBERNATE_EXIT
1124 o Allow to put the entire Link into HIBERNATE power mode and to wake the Link up
1125  Affects the local and the peer UniPort (UniPro L1.5-L4 and MPHY)
1126 NOTE After exit from Hibernate all UniPro Transport Layer attributes (including L4 T_PeerDeviceID,
1127 L4 T_PeerCPortID, L4 T_ConnectionState, etc.) will be reset to their reset values. All required attributes
1128 must be restored properly on both ends before communication can resume.
1129  DME_POWERMODE
1130 o Allows to change the power mode of one or both directions of the MPHY Link
1131  DME_TEST_MODE (optional)
1132 o Allows to set the peer UniPro Device on the Link in a specific test mode
1133  DME_LINKLOST
1134 o Indication of the UniPro stack towards higher layers that the Link has been lost
1135  DME_ERROR
1136 o Indication of the UniPro stack towards higher layers that an error condition has been
1137 encountered in one of the UniPro Layers
1138
Page 56
1139 9.5 UniPro/UFS Transport Protocol Address Mapping

1140 UniPro has fundamentally two levels of addressing to control the exchange of information between
1141 remote UniPro entities
1142 Network Layer (L3): Device ID, lowest level of addressability
1143 o Provided for future UniPro networks of devices. During connection establishment the side
1144 creating a connection uses this value to select the physical entity on the remote end of the
1145 connection. It shall be considered static for the lifetime of this connection.
1146 Transport Layer (L4): CPort ID, highest level of end-to-end addressability
1147 o During connection establishment the side creating a connection uses this value to select the
1148 logical entity inside the targeted UniPro device on the remote end of the connection. It shall be
1149 considered static for the lifetime of this connection.
1150 UFS will adopt the addressing notation of the SCSI Architecture Model [SAM] which defines an
1151 ‘Address Nexus’ (I_T_L_Q) which is composed of
1152  Initiator Port Identifier (I)
1153  Target Port Identifier (T)
1154  Logical Unit Number (L)
1155  Command Identifier (Q).
1156 An I_T_L_Q Nexus uniquely defines a specific command slot (Q) inside a specific Logical Unit (L)
1157 connected to a specific Device Target Port (T) accessed through a specific Host Initiator Port (I).
1158 UFS Interconnect Layer (UniPro) addresses are only related to the I_T part of the Nexus:
1159  UFS systems based on this version of the standard shall only support a single UFS host
1160 containing a single UFS Initiator Port.
1161 o Hence, this version of the standard only requires and uses a single UniPro CPort on the host
1162 side.
1163  UFS systems based on this version of the standard shall only support a single UFS device
1164 containing a single UFS Target Port.
1165 o Hence, this version of the standard only requires and uses a single UniPro CPort on the
1166 Device side.
1167 Mapping Rules
1168  UFS Port IDs (I and T) shall be 12 bit wide each
1169 o The most significant 7 bits of each UFS Port ID shall contain the UniPro Network Layer
1170 Device ID of the entity (host or device) containing said UFS Port
1171  The UniPro Network Layer Device ID reset value shall be 0 for the Host
1172  The UniPro Network Layer Device ID reset value shall be 1 for the Device
1173 o The least significant 5 bits of each UFS Port ID shall contain the UniPro Transport Layer
1174 CPort ID which said UFS Port uses to communicate to the remote entity
1175  The UniPro Transport Layer CPort ID reset value shall be 0 for the Host
1176  The UniPro Transport Layer CPort ID reset value shall be 0 for the Device
1177 As a result of the aforementioned mapping after reset the I_T Nexus which UFS uses defaults to:
1178  UFS I_T Nexus = [000 0000b | 0 0000b| 000 0001b | 0 0000b] = 20h = 32
Page 57
1179 9.5 UniPro/UFS Transport Protocol Address Mapping (cont’d)

1180 The single UniPro connection between the UTP layer of an UFS host and the UTP layer of an UFS device
1181 can be uniquely identified by the UFS I_T Nexus above.
1182 NOTE The I_T Nexus elements (Device IDs and CPort IDs) can be modified by the Host after reset using the
1183 DME Service Primitives:
1184 o The “I” Nexus element may be modified by the Host using the DME_SET primitive
1185 o The “T” Nexus element may be modified by the Host using DME_PEER_SET primitive
1186 All attributes of the CPort on the Host side (including, e.g., “T_ConnectionState”) can be checked and
1187 modified by the Host using the DME_GET and DME_SET primitives after reset.
1188 All attributes of the CPort on the Device side (including, e.g., the “T_ConnectionState”) can be checked
1189 and modified by the Host using the DME_PEER_GET and DME_PEER_SET primitives after reset.
1190 9.6 Options and Tunable Parameters of UniPro
1191 MIPI UniPro has been designed as a versatile protocol specification and as such has several options and
1192 parameters which an application like UFS should specify for its specialized UniPro usage scenario.
1193 Annex G of the UniPro specification details all of the possible choices.
1194 The remaining sections of this chapter define the specific requirements towards these options and
1195 parameters for this version of UFS standard. They apply to UniPro implementations for the UFS host side
1196 as well as to UniPro implementations for the UFS device side if not explicitly stated otherwise below.
1197 9.6.1 UniPro PHY Adapter
1198 For MIPI M-PHY related attribute values and implementation options as defined by UFS please refer to
1199 8.6 “UFS PHY Attributes”.
1200 9.6.2 UniPro Data Link Layer
1201  Shall implement the Data Link Layer Traffic Class “Best Effort” (TC 0)
1202  Data Link Layer Traffic Class 1 (TC1: ‘Low Latency’) is not required
1203  TX preemption capability is not required
1204  Shall provide at least DL_MTU bytes of Data Link Layer RX and TX buffering
1205  Shall support transmission and reception of maximum sized L2 frames (DL_MTU)
1206 9.6.3 UniPro Network Layer
1207  Shall support transmission and reception of maximum sized L3 packets (N_MTU)
1208 9.6.4 UniPro Transport Layer
1209  UFS Hosts and Devices shall implement at least 1 CPort
1210 NOTE JESD220B only requires and uses a single CPort on either side of the Link.
1211  UFS does not mandate any CPort arbitration scheme beyond the UniPro default if more than one
1212 CPort is implemented
1213  Shall support the UniPro Test Feature
1214  UFS does not require the UniPro End-to-End Flow Control mechanism
1215 o UFS will not use ‘Controlled Segment Dropping’ (CSD)
1216  Hence CSD shall be disabled
1217  UFS will not use "CPort Safety Valve" (CSV). Hence, CSV shall be disabled.
1218  Shall support transmission and reception of maximum sized L4 segments (T_MTU) .
Page 58
1219 9.6.5 UniPro Device Management Entity Transport Layer

1220 Table 9.1 details which DME Service Primitives are defined as mandatory or optional by UniPro.
1221 Additionally, it details which DME Service Primitives are required to be implemented by UFS Hosts and
1222 by UFS Devices.
1223
1224 Table 9.1 — DME Service Primitives
DME Service Primitive UniPro UFS Host UFS Device UFS Usage Limitations
DME_GET Mandatory Implement Implement
UFS Device shall not use
this primitive to modify the
DME_SET Mandatory Implement Implement
local PA_PWRMode
attribute
Shall not be used by UFS
DME_PEER_GET Optional Implement Illegal
Device
DME_PEER_SET Optional Implement Illegal
Device
DME_POWERON Optional Optional Illegal
Device
DME_POWEROFF Optional Optional Illegal
Device
DME_ENABLE Mandatory Implement Implement
UFS Device shall only use
DME_RESET Mandatory Implement Implement this primitive after
DME_LINKLOST.ind
DME_ENDPOINTRESET Mandatory Implement Implement
Device
DME_LINKSTARTUP Mandatory Implement Implement
DME_LINKLOST Mandatory Implement Implement Event indication only
DME_HIBERNATE_ENTER Mandatory Implement Implement
Device
DME_HIBERNATE_EXIT Mandatory Implement Implement
Device
DME_POWERMODE Mandatory Implement Implement
Device
DME_TEST_MODE Optional Optional Illegal
Host
DME_ERROR Mandatory Implement Implement Event indication only
DME_RXPWRSTATE D-PHY only N/A N/A N/A for UFS
NOTE 1 A UFS Device shall only use DME Service Primitives if their usage is explicitly defined by this standard. In
such a case, UFS specifically defines the allowed parameter range and the sequence of actions.
Page 59
1225 9.6.6 UniPro Attributes

1226 To optimize the UFS Boot procedure the UFS UIC implementation shall use the default reset values for
1227 all UniPro Attributes as defined by the MIPI UniPro specification. As an exception to this, the reset
1228 values of Network Layer Attributes and specific Attributes for CPort 0 shall reflect the settings which
1229 have been defined in the sections above and therefore shall contain the values as depicted in Table 9.2.
1230
1231 Table 9.2 — UniPro Attribute
UFS Host UFS Device
UniPro Attribute Name
Reset Value Reset Value
N_DeviceID 0 1
N_DeviceID_valid TRUE TRUE
T_PeerDeviceID 1 0
T_PeerCPortID 0 0
6 6
T_CPortFlags (E2E_FC off, CSD off, (E2E_FC off, CSD off,
CSV off) CSV off)
T_ConnectionState 1 (CONNECTED) 1 (CONNECTED)
T_TrafficClass 0 0
PA_MaxDataLanes 2 2
PA_AvailTxDataLanes 1, 2 1, 2
PA_AvailRxDataLanes 1, 2 1, 2
NOTE A UFS device will support either: one TX lane and one RX lane or two TX lanes
and two RX lanes
1232 .
Page 60
1233 10 UFS TRANSPORT PROTOCOL (UTP) LAYER
1234 10.1 Overview

1235 The SCSI Architecture Model [SAM] is used as the general architectural model for UTP, and the SAM
1236 Task Management functions for task management. A task is generally a SCSI command or service
1237 request. While the model uses the SCSI command set as the command set, it is not necessary to use SCSI
1238 commands exclusively.
1239 The SAM architecture is a client‐server model or more commonly a request‐response architecture. Clients
1240 are called Initiators and servers are called Targets. Initiators and Targets are mapped into UFS physical
1241 network devices. An Initiator issues commands or service requests to a Target that will perform the
1242 service requested. A Target is a Logical Unit (LU) contained within a UFS device. A UFS device will
1243 contain one or more Logical Units. A Logical Unit is an independent processing entity within the device.
1244 A client request is directed to a single Logical Unit within a device. A Logical Unit will receive and
1245 process the client command or request. Each Logical Unit has an address within the Target device called a
1246 Logical Unit Number (LUN).
1247 Communication between the Initiator and Target is divided into a series of messages. These messages are
1248 formatted into UFS Protocol Information Units (UPIU) as defined within this specification. There are a
1249 number of different UPIU types defined. All UPIU structures contain a common header area at the
1250 beginning of the data structure (lowest address). The remaining fields of the structure vary according to
1251 the type of UPIU.
1252 A Task is a command or sequence of actions that perform a requested service. A Logical Unit contains a
1253 task queue that will support the processing of one or more Tasks. The Task queue is managed by the
1254 Logical Unit. A unique Initiator provided Task Tag is generated by the Initiator when building the Task.
1255 This Task Tag is used by the Target and the Initiator to distinguish between multiple Tasks. All
1256 transactions and sequences associated with a particular Task will contain that Task Tag in the transaction
1257 associated data structures.
1258 Command structures consist of Command Descriptor Blocks (CDB) that contain a command opcode and
1259 related parameters, flags and attributes. The description of the CDB content and structure are defined in
1260 detail in [SAM], [SBC] and [SPC] INCITS T10 draft standards.
1261 A command transaction consists of a Command, an optional Data Phase, and a Status Phase. These
1262 transactions are represented in the form of UPIU structures. The Command Phase delivers the command
1263 information and supporting parameters from the Initiator to the Target. If a Data Phase is required, the
1264 direction of data flow is relative to the Initiator (host). A data WRITE travels from Initiator to Target. A
1265 data READ travels from Target to Initiator. At the completion of the command request the Target will
1266 deliver a response to the Initiator during the Status Phase. The response will contain the status and a UFS
1267 response status indicating successful completion or failure of the command. If an error is indicated the
1268 response will contain additional detailed UFS error information.
1269
Page 61
1270 10.2 UTP and UniPro Specific Overview

1271 UTP will deliver commands, data and responses as standard message packets (T_SDU) over the UniPro
1272 network.
1273 The UFS transactions will be grouped into data structures called UFS Protocol Information Units (UPIU).
1274 There are UPIU’s defined for UFS SCSI commands, responses, data in and data out, task management,
1275 utility functions, vendor functions, transaction synchronization and control. The list is extensible for
1276 future additions.
1277 For enumeration and configuration, UFS supports a system of Descriptors, Attributes and Flags that
1278 define and control the specifics of the device, including operating characteristics, interfaces, number of
1279 logical units, operating speeds, power profiles, etc. The system is a hierarchical tree of related elements. It
1280 is open to be expanded.
1281 10.2.1 Phases
1282 The SCSI based Command protocol requires that the UPIU packets follow the transitions required to
1283 execute a command. Briefly, a command execution requires the sending of a COMMAND UPIU, zero or
1284 more DATA IN UPIU or DATA OUT UPIU packets and terminates with a RESPONSE UPIU that
1285 contains the status.
1286 10.2.2 Data Pacing
1287 A device may have limited memory resources for buffering or limited processing throughput. During a
1288 Command that requires a large Data Out transaction the Target device can pace the Data Out phase by
1289 sending a READY TO TRANSFER UPIU when it is ready for the next DATA OUT UPIU. In addition,
1290 the READY TO TRANSFER UPIU contains an embedded transfer context that can be used initiate a
1291 DMA transfer on a per packet basis at the initiating device (the Host).
1292 During the Data In phase, no READY TO TRANSFER UPIU is required as the initiating Host has the
1293 ability to specify the size of the Data In transfer and thereby is able to allocate in advance the appropriate
1294 memory resources for the incoming data. A device issued DATA IN UPIU packet also contains an
1295 embedded DMA context that can be used to initiate a DMA transfer on a per packet basis.
1296 10.2.3 UniPro
1297 In keeping with the requirements of the UniPro Protocol the UFS Initiator and Target will divide its
1298 transactions into UniPro messages that will contain UPIU’s. UniPro messages can handle T_SDU
1299 messages of theoretically unlimited size. UFS will impose a practicable limit on the maximum T_SDU
1300 message size. The limit is 65600 bytes which includes UPIU header, optional extended headers area and
1301 data segment. The minimum message size is determined by the basic header format, which is 32 bytes.
1302 There is a possibility that in the future this value will increase to allow a larger data segment area.
1303
Page 62
1304 10.3 UFS Transport Protocol Transactions

1305 10.3.1 Overview
1306 UFS transactions consist of packets called UFS Protocol Information Units (UPIU) that travel between
1307 devices on the UniPro bus. A transaction begins between an Initiator and a Target in the form of a
1308 Request‐Response operation. The Initiator starts the sequence of transactions by sending a request to a
1309 Target device and LUN. The Target will then respond with a series of transactions that eventually end in a
1310 response transaction.
1311 All UFS UPIU’s consist of a single basic header segment, transaction specific fields, possibly one or
1312 more extended header segments and zero or more data segments.
1313 A basic header segment has a fixed length of 12 bytes. The minimum UPIU size is 32 bytes which
1314 includes a basic header segment and transaction specific fields.
1315 The maximum UPIU size is defined as being 65600 bytes.
1316 The UPIU format is flexible enough to be easily extended to support future transactions and larger data
1317 segments and will allow the application of this protocol to network protocols other than UniPro.
1318 10.4 Service Delivery Subsystem
1319 The Service Delivery Subsystem is an I/O system that transmits service requests and responses between
1320 Initiators and logical units within Targets connected via a physical or logical bus. The UFS UTP attempts
1321 to define a protocol that is independent of the Service Delivery Subsystem. This will allow for the easy
1322 porting of UTP to different Service Delivery Subsystems.
1323 Currently, UFS is using the MIPI UniPro bus and the MIPI M‐PHY as the Service Delivery Subsystem.
1324 For convenience and to aid in better understanding, portions of this specification will directly reference
1325 UniPro and M‐PHY. Regardless of these references, the UTP protocol is independent of the Service
1326 Delivery Subsystem and should be able to port to other I/O systems.
1327 UPIU structures will be handed off to MIPI UniPro as UniPro Service Data Units (T_SDU). Currently,
1328 the UniPro T_SDU requires no additional headers or trailer wrapped around the UPIU structure. This
1329 means that the T_SDU size will be exactly the UPIU size. The minimum size T_SDU will be 32 bytes.
1330 The maximum T_SDU size will be 65600 bytes.
1331 10.4.1 UPIU Transaction Codes
1332 Every UPIU data structure contains a Transaction Code. This code defines the content and implied
1333 function or use of the UPIU data structure. The following chart lists currently defined transaction codes.
1334 Table 10.1 — UPIU Transaction Codes
Initiator To Target Transaction Code Target to Initiator Transaction Code
NOP OUT 00 0000b NOP IN 10 0000b
COMMAND 00 0001b RESPONSE 10 0001b
DATA OUT 00 0010b DATA IN 10 0010b
TASK MANAGEMENT TASK MANAGEMENT
00 0100b 10 0100b
REQUEST RESPONSE
Reserved 01 0001b READY TO TRANSFER 11 0001b
QUERY REQUEST 01 0110b QUERY RESPONSE 11 0110b
Reserved 01 1111b REJECT UPIU 11 1111b
Reserved Others Reserved Others
NOTE 1 Bit 5 of the Transaction Code indicates the direction of flow and the originator of the UPIU: when equal ‘0’
the originator is the Host device , when equal ‘1’ the originator is the Target device.
Page 63
1335 10.4.1 UPIU Transaction Codes (cont’d)

1336 Table 10.2 — UPIU Transaction Code Definitions
UPIU Data Structure Description
The NOP Out transaction acts as a ping from an initiator to a target. It can be
NOP Out
used to check for a connection path to a device.
The NOP In transaction is a target response to an initiator when responding to
NOP In
a NOP Out request.
The Command transaction originates in the Initiator (host) and is sent to a
logical unit within a Target device. A COMMAND UPIU will contain a
Command
Command Descriptor Block as the command and the command parameters.
This represents the COMMAND phase of the command.
The Response transaction originates in the Target and is sent back to the
Initiator (host). A RESPONSE UPIU will contain a command specific operation
Response
status and other response information. This represents the STATUS phase of
the command.
The Data Out transaction originates in the Initiator (host) and is used to send
Data Out data from the Initiator to the Target (device). This represents the DATA OUT
phase of a command.
The Data In transaction originates in the Target (device) and is used to send
Data In data from the Target to the Initiator (host). This represents the DATA IN phase
of a command.
This transaction type carries SCSI Architecture Model (SAM) task
Task Management management function requests originating at the Initiator and terminating at the
Request Target. The standard functions are defined by [SAM]. Addition functions may
be defined by UFS.
This transaction type carries SCSI Architecture Model (SAM) task
Task Management
management function responses originating in the Target and terminating at
Response
the Initiator.
The Target device will send a Ready To Transfer transaction when it is ready
to receive the next DATA OUT UPIU and has sufficient buffer space to receive
the data. The Target can send multiple Ready To Transfer UPIU if it has buffer
Ready To Transfer space to receive multiple DATA OUT UPIU packets. The maximum data buffer
size is negotiated between the Initiator and Target during enumeration and
configuration. The READY TO TRANSFER UPIU contains a DMA context and
can be used to setup and trigger a DMA action within a host controller.
This transaction originates in the Initiator and is used to request descriptor
Query Request data from the Target. This transaction is defined outside of the Command and
Task Management functions and is defined exclusively by UFS.
This transaction originates in the Target and provides requested descriptor
information to the Initiator in response of the Query Request transaction. This
Query Response
transaction is defined outside of the Command and Task Management
functions and is defined exclusively by UFS.
The Reject transaction originates in the Target and is sent back to the Initiator
(host). A REJECT UPIU is generated when Target is not able to interpret
Reject
and/or execute an UPIU received from the Initiator due to wrong values in
some of its fields.
Page 64
1337 10.5 General UFS Protocol Information Unit Format

1338 Table 10.3 represents the general structure of a UPIU. All UPIU’s will contain a fixed size and location
1339 basic header and additional fields as required to support the transaction type.
1340 Table 10.3 — General format of the UFS Protocol Information Unit
General UPIU Format
0 1 2 3
Transaction Type Flags LUN Task Tag
4 5 6 7
Command Query Function /
Reserved Response Status
Set Type Task Manag. Function
8 9 10 (MSB) 11 (LSB)
Total EHS Length Device Information Data Segment Length
12 13 14 15
16 19
20 Transaction Specific Fields 23
24 27
28 31
k k+1 k+2 k+3

Extra Header Segment (EHS) 1
…
j j+1 j+2 j+3
Extra Header Segment (EHS) N
Header E2ECRC (omit if HD=0)
Data Segment
Data E2ECRC (omit if DD=0)
NOTE 1 Extra Header Segments are not used in JESD220B, therefore the Total EHS Length value shall be set zero.
1341
Page 65

1343 UPIU total size will vary depending upon the UPIU transaction type but all UPIU sizes will be an integer
1344 multiple of 32‐bits, meaning they will be addressed on a 4‐byte boundary. If the aggregation of data and
1345 header segments does not end on a 32‐bit boundary then additional padding will be added to round up the
1346 UPIU to the next 32‐bit, 4‐byte address boundary.
1347 The UPIU size can be fixed or variable depending upon the Transaction Type field and extension flags.
1348 Some Transaction Types will have different lengths for the same code others will always be a fixed size.
1349 In addition, any UPIU can be extended if necessary to include extra header and data segments. The
1350 general format allows for extension and has flags and size fields defined within the structure to indicate to
1351 the processing entity where the extension areas are located within the structure and their size (not
1352 including padding) and in some cases the type of extension data.
1353 10.5.2 Basic Header Format
1354 This is the format of the basic header contained within every UPIU structure. This data packet will be sent
1355 between Initiators and Targets and will be part of a larger function specific UPIU. There is enough
1356 information in this header to allow the Initiator or the Target to track the destination and the source, the
1357 function request, if additional data and parameters are required and whether they are included in this
1358 UPIU or will follow in subsequent UPIU’s.
1359 The smallest sized UPIU is currently defined to have 32 bytes. The 32 bytes area will contain the basic
1360 header plus additional fields. This means that the smallest datum sent over the Service Delivery
1361 Subsystem will be 32 bytes.
1362 Table 10.4 — Basic Header Format
Basic UPIU Header Format
Transaction Type Flags LUN Task Tag
Command Set Query Function,
Reserved Response Status
Type Task Manag. Function
Total EHS Length Device Information Data Segment Length
1363 Transaction Type

1364 The Transaction Type indicates the type of request or response contained within the data structure. The
1365 Transaction Type contains an opcode as defined in 10.4.1.
1366 Table 10.5 — Transaction Type Format
Transaction Type Bits
7 6 5 4 3 2 1 0
HD DD Transaction Code
1367 HD
1368 The HD bit when set to ‘1’ specifies that an end-to-end CRC of all Header Segments is included within
1369 the UPIU. The CRC fields include all fields within the header area. The CRC is placed at the 32-bit word
1370 location following the header.
1371 End-to-end CRC is not supported in this version of the standard, therefore HD shall be ‘0’.
1372
Page 66
1373 10.5.2 Basic Header Format (cont’d)

1374 DD
1375 The DD bit when set to ‘1’ specifies that an end-to-end CRC of the Data Segment is included with the
1376 UPIU. The 32-bit CRC is calculated over all the fields within the Data Segment. The 32-bit CRC word is
1377 placed at the end of the Data Segment. This will be the last word location of the UPIU.
1378 End-to-end CRC is not supported in this version of the standard, therefore DD shall be ‘0’.
1379 Transaction Code
1380 The Transaction Code indicates the operation that is represented within the data fields of the UPIU and
1381 the number and location of the defined fields within the UPIU.
1382 Flags
1383 The content of the Flags field vary with the Transaction Type opcode (1).
1384 Table 10.6 — UPIU Flags
Operational Flags Reserved Task Attribute
UPIU Type
Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
NOP Out - - - - - - - -
NOP In - - - - - - - -
Command - R W - - - ATTR
Response - O U D - - - -
Data Out - - - - - - - -
Data In - - - - - - - -
Ready to Transfer - - - - - - - -
Reject - - - - - - - -
Query Request - - - - - - - -
Query Response - - - - - - - -
Task Management Request - - - - - - - -
Task Management Response - - - - - - - -
NOTE 1 “-“ denotes reserved values.
1385
1386 Table 10.7 — Task Attribute definition
Task Attribute Bit 1 Bit 0
Simple 0 0
Ordered 0 1
Head of Queue 1 0
ACA (Not Used) 1 1
1387
Page 67

1389 Response
1390 If a response is required from a Target this field indicates whether the requested function succeeded or
1391 failed. This field is reserved in UPIU transactions from Initiator to Target.
1392 Table 10.8 — UTP Response Values
Opcode Response Description
00h Target Success
01h Target Failure
02h-7Fh Reserved
80h-FFh Vendor Specific
1393 Status
1394 This field contains the SCSI status (as defined in [SAM]) if the transaction is a RESPONSE UPIU for a
1395 COMMAND UPIU with Command Set Type = 0x00 (SCSI Command). Otherwise it contains an opcode
1396 specific status or it is reserved.
1397 Reserved
1398 All fields marked as reserved shall contain a value of zero.
1399 LUN
1400 This field contains the Logical Unit Number to which a request is targeted. Target devices will contain at
1401 a minimum one logical unit numbered unit 0. This field is generated by the Initiator and maintained by
1402 the Target and Initiator for all UPIU transactions relating to a single request or task.
1403 Task Tag
1404 The Task Tag is generated by the Initiator when creating a task request. This field will be maintained by
1405 the Initiator and Target for all UPIU transactions relating to a single task. The Initiator will contain a
1406 register or variable that represents the Task Tag value. The Initiator will generate unique Task Tag by
1407 incrementing the internal variable when creating a new task request. When a task request is made up or
1408 generate a series of UPIU transactions, all UPIU will contain the same value in the Task Tag field.
1409 In particular, the same Task Tag value shall be maintained for the UPIU grouped in each row of Table
1410 10.9.
1411 Table 10.9 — UPIU associated to a single task
Initiator UPIU Target UPIU
NOP Out NOP In
Command, Data Out Ready to Transfer, Response
Command Data In, Response
Task Management Request Task Management Response
Query Request Query Response
1412
1413
Page 68

1415 Command Set Type
1416 Command set type is four bits. This field indicates the command set type the Command and RESPONSE
1417 UPIU is associated with. This field is defined for the COMMAND UPIU and the RESPONSE UPIU. This
1418 field is reserved in all other UPIU’s. This field shall be used to indicate the type of command that is in the
1419 CDB field. The currently supported command types are listed in Table 10.10.
1420 Table 10.10 — Command Set Type
Value Description
0h SCSI Command Set (SPC, SBC)
1h UFS Specific Command Set
2h … 7h Reserved
8h … Fh Vendor Specific Set
NOTE 1 JESD220B does not define any UFS specific command,
therefore the value 1h is reserved for future use.
1421
1422 Query Function, Task Manag. Function
1423 This field is used in QUERY REQUEST and QUERY RESPONSE UPIU’s to define the Query function,
1424 and in TASK MANAGEMENT REQUEST UPIU to define the task management function.
1425 Device Information
1426 This field provides device level information required by specific UFS functionality in all RESPONSE
1427 UPIU.
1428 Total Extra Header Segment Length
1429 This field represents the size in 32‐bit units (DWORDS) of all Extra Header Segments contained within
1430 the UPIU. This field is used if additional header segments are needed. The length of each Extra Header
1431 Segment shall be a multiple of four. The value in this field is the number of total number of bytes in all
1432 EHS divided by four.
1433
( )
1434
1435 The maximum size of all EHS fields combined is 1024 bytes. A value of zero in this field indicates that
1436 there are no EHS contained within the UPIU.
1437 Extra Header Segments are not used in this standard, therefore the value of this field shall be set zero.
1438
Page 69

1440 Data Segment Length
1441 The Data Segment Length field contains the number of valid bytes within the Data Segment of the UPIU.
1442 When the number of bytes within the Data Segment is not a multiple of four then the last 32‐bit field will
1443 be padded with zeros to terminate on the next nearest 32‐bit boundary. The number of 32‐bit units
1444 (DWORDS) that make up the Data Segment is calculated as follows:
1445
( )
1446
1447 Since the Data Segment Length field size is two bytes, the data segment can contain a maximum of 65535
1448 valid bytes. A value of zero in this field indicates that there is no Data Segment within the UPIU.
1449 Transaction Specific Fields
1450 Additional fields as required by certain Transaction Codes are located within this area. For UTP, this area
1451 starts at byte address 12 within the UPIU and terminates on a 32 byte boundary at byte address 31. Since
1452 all UPIU contain a 12 byte Basic Header this leaves 20 bytes remaining for this area.
1453 Extra Header Segments
1454 The Extra Header Segments exist if the Total EHS Length field contains a non‐zero value. For UTP, this
1455 area will start at byte address 32 within the UPIU. The UPIU may contain zero or more EHS. The length
1456 of each Extra Header Segment shall be a multiple of four. This standard does not use EHS.
1457 Data Segment
1458 The Data Segment field starts on the next 32‐bit (DWORD) boundary after the EHS area within the
1459 UPIU. For UTP, there are no EHS areas used meaning that the Data Segment will begin at byte address
1460 32 (byte address 36 if E2ECRC is enabled) within the UPIU. The Data Segment will be a multiple of 32‐
1461 bits, thereby making the UPIU packet size a multiple of 4 bytes. The Data Segment Length field can
1462 contain a value that is not a multiple of 4 bytes but the Data Segment area will be padded with zeros to fill
1463 to the next nearest 32‐bit (DWORD) boundary. The Data Segment Length field indicates the number of
1464 valid bytes within the Data Segment.
1465
1466
Page 70
1467 10.5.3 COMMAND UPIU

1468 10.5.3.1 Overview
1469 The COMMAND UPIU contains the basic UPIU header plus additional information needed to specify a
1470 command. The Initiator will generate this UPIU and send it to a Target to request a SCSI command
1471 service to be performed by the Target.
1472 Table 10.11 — COMMAND UPIU
COMMAND UPIU
0 1 2 3
xx00 0001b Flags LUN Task Tag
4 5 6 7
Command
Reserved Reserved Reserved Reserved
Set Type
8 9 10 (MSB) 11 (LSB)
Total EHS Length (00h) Reserved Data Segment Length (0000h)
12 (MSB) 13 14 15 (LSB)
Expected Data Transfer Length
16 17 18 19
CDB[0] CDB[1] CDB[2] CDB[3]
20 21 22 23
24 25 26 27
28 29 30 31
CDB[12] CDB[13] CDB[14] CDB[15]
1473
1474
Page 71
1475 10.5.3 COMMAND UPIU (cont’d)

1476 10.5.3.2 Basic Header
1477 The first 12 bytes of the COMMAND UPIU contain the Basic Header as described in 10.5.2 “Basic
1478 Header Format”. Specific details follow below.
1480 A type code value of xx00 0001b indicates a COMMAND UPIU.
1481 Flags
1482 The following table describes the flags used in COMMAND UPIU.
1483
1484 Table 10.12 — Flags Definition for COMMAND UPIU
Flag Description
A value of ‘1’ in the .R flag indicates that the command requires that a data read operation
(incoming data) from Target to Initiator is required. If .R is set to ‘1’ then .W must be set to
Flags.R
‘0’. If .R and .W are set to ‘0’ then no data transfer is required for this command and the
Expected Data Transfer Length field is ignored.
A value of ‘1’ in the .W flag indicates that the command requires a data write operation
(outgoing data) from Initiator to Target. If .W is set to ‘1’ then .R must be set to ‘0’. If .W and
Flags.W
.R are set to ‘0’ then no data transfer is required for this command and the Expected Data
Transfer Length field is ignored.
The .ATTR field contains the task attribute value as defined by [SAM].
ATTR Definition
Task Attribute Bit 1 Bit 0
Simple 0 0
Flags.ATTR
Ordered 0 1
Head of Queue 1 0
ACA (Not Used) 1 1
The relative order of execution between Head of Queue commands is left for implementation.

1486 The Data Segment Length field shall contain zero as there is no Data Segment in this UPIU.
1487
Page 72
1488 10.5.3 COMMAND UPIU (cont’d)

1489 Expected Data Transfer Length
1490 The Expected Data Transfer Length field contains a value that represents the number of bytes that are
1491 required to complete the SCSI command request. Data may be transferred from the Initiator to the Target
1492 or from the Target to the Initiator. This field is valid only if one of the Flags.W or Flags.R bits are set to
1493 ‘1’.
1494 For a write operation the .W flag shall be set to ‘1’ and the .R flag shall be set to ‘0’ and the value in this
1495 field represents the number of bytes that the Initiator expects to transfer to the Target.
1496 For a read operation the .R flag shall be set to ‘1’ and the .W flag shall be set to ‘0’ and the value in this
1497 field represents the number of bytes that the Initiator expects the Target to transfer to it.
1498 This model requires that the Initiator (Host) will allocate sufficient buffer space to receive the full size of
1499 the data requested by a command that requires a Data In operation. That size measured in bytes shall be
1500 the value in Expected Data Transfer Length field. This requirement is important in order to realize the full
1501 throughput of the Data In phase without the use of additional handshaking UPIU’s.
1502 The Initiator may request a Data Out size larger than the size of the Target’s receive buffer. In this case,
1503 the Target will pace the DATA OUT UPIU’s by sending READY TO TRANSFER UPIU’s as needed.
1504 The Initiator will not send a DATA OUT UPIU before it receives a READY TO TRANSFER UPIU.
1505 CDB
1506 The CDB fields contain the Command Descriptor Block. This area is an array of 16 bytes that will
1507 contain a standard Command Descriptor Block as defined by one of the supported UFS Command Set
1508 Types. For SCSI commands, standards such as [SPC] can be referenced. Up to a 16 byte CDB can be
1509 utilized. The CDB size is determined implicitly indicated by the group bits of the operation code field in
1510 CDB[0] for SCSI, which is the SCSI command operation code. If the CDB size is lower than 16 bytes
1511 the unused COMMAND UPIU bytes are defined as reserved. For other commands, the CDB size is
1512 dependent upon the command opcode.
1514 The Command Set Type field will specify an enumerated value that indicates which particular command
1515 set is used to define the command bytes in the CDB fields. See10.5.2, Command Set Type description,
1516 and Table 10.10 for details.
1517
1518
Page 73
1519 10.5.4 RESPONSE UPIU

1520 10.5.4.1 Overview
1521 The RESPONSE UPIU contains the basic UPIU header plus additional information indicating the
1522 command and system level status resulting from the successful or failed execution of a Command
1523 Request UPIU. The Target will generate this UPIU and send it to the Initiator after it has completed the
1524 requested task.
1525 Table 10.13 — RESPONSE UPIU
RESPONSE UPIU
0 1 2 3
4 5 6 7
Command
Reserved Reserved Response Status
Set Type
8 9 10 (MSB) 11 (LSB)
Total EHS Length (00h) Device Information Data Segment Length
12 (MSB) 13 14 15 (LSB)
Residual Transfer Count
16 17 18 19
Reserved
20 21 22 23
Reserved
24 25 26 27
Reserved
28 29 30 31
Reserved
k (MSB) k+1 (LSB) k+2 k+3
Sense Data Length Sense Data[0] Sense Data[1]
… … … …
k+16 k+17 k+18 k+19
Sense Data[14] Sense Data[15] Sense Data[16] Sense Data[17]
NOTE 1 k = 32 if HD = 0.
1526
Page 74

1528 The first 12 bytes of the RESPONSE UPIU contain the Basic Header as described in 10.5.2 “Basic
1529 Header Format”. Specific details follow.
1531 A type code value of xx10 0001b indicates a RESPONSE UPIU.
1532 Flags
1533 The following table describes the flags used in RESPONSE UPIU.
Flag Description
The Flags.O flag will be set to ‘1’ to indicate that a data overflow occurred during the task
execution: the Target has more data bytes to transfer than the Initiator requested.
The Residual Transfer Count field will indicate the number of available bytes not transferred
Flags.O from the Target to the Initiator or vice versa.
The Residual Transfer Count will be set to the value difference of the total number of bytes
available to be transferred and the Expected Data Transfer Length value received in the
COMMAND UPIU. See below for further explanation.
The Flags.U flag will be set to ‘1’ to indicate that a data underflow occurred during the task
execution: the Target has less data bytes to transfer than the Initiator requested.
The Residual Transfer Count field will indicate the number of bytes that were not transferred
Flags.U from the Target to the Initiator or vice versa.
The Residual Transfer Count will be set to the value difference of the Expected Data
Transfer Length value received in the COMMAND UPIU and the actual number of bytes
transferred. See below for further explanation.
The .D flag will be set to ‘1’ to indicate that a UTP Data Out Mismatch error occurred during
the task execution: the data buffer offset and/or the data transfer count parameter in the
Flags.D
Data Out UPIU doesn’t match the corresponding parameters in the RTT request. See
13.4.12 for further explanation.
1534
1536 The Command Set Type field will specify an enumerated value that indicates which particular command
1537 set is used to define the command bytes in the CDB fields. See 10.5.2 “Basic Header Format” for details.
1538 Response
1539 The Response field will contain the UFS response that indicates the UFS defined overall success or
1540 failure of the series of Command, Data and RESPONSE UPIU’s that make up the execution of a task. See
1541 10.5.2 “Basic Header Format” for details.
1542
Page 75
1543 10.5.4.2 Basic Header (cont’d)

1544 Status
1545 The Status field contains the command set specific status for a specific command issued by the Initiator.
1546 The Status field is command set specific. The Command Set Type field will indicate with which
1547 command set the status is associated. Specific command sets may or may not define detailed extended
1548 status indicated as Sense Data. If the command requires extended status, that information will be stored in
1549 the Sense Data field.
1550 SCSI Command Set Status
1551 When the Command Set Type field indicates SCSI Command Set the Status field will contain the
1552 standard SPC defined SCSI status value. Possible values are listed in the table below. See the [SPC]
1553 or [SAM] for detailed definition of the status conditions.
1554 A GOOD status indicates successful SCSI completion and therefore no Sense Data will be returned.
1555 A status of CHECK CONDITION requires that the Data Segment contain Sense Data for the failed
1556 command.
1557 Other status values may or may not return Sense Data. In this case a non-zero value in the Data
1558 Segment Length field indicates that this UPIU contains Sense Data in the Data Segment area.
1559 ‘M’ indicates mandatory implementation of this field and the value specified if fixed. ‘O’ indicates
1560 that the support of this field is optional; if it is not supported then a value of zero should be inserted in
1561 the field otherwise the value will be indicated as described. n/a indicates “not applicable” to UFS.
1562 Table 10.14 — SCSI Status Values
Opcode Response Description Use
00h GOOD M
02h CHECK CONDITION M
04h CONDITION MET n/a
08h BUSY M
18h RESERVATION CONFLICT O
28h TASK SET FULL M
30h ACA ACTIVE n/a
40h TASK ABORTED n/a
GOOD - This status indicates that the device has completed the command without error.
CHECK CONDITION - This status indicates that the device has completed the command with error or other actions are
required to process the result. Valid Sense Data for the last command processed will be returned within the response
UPIU when this status occurs.
CONDITION MET - Not used for UFS.
BUSY - This status indicates that the logical unit is busy. When the logical unit is unable to accept a command this
status will be returned. Issuing the command at a later time is the standard recovery action.
RESERVATION CONFLICT - This status is returned when execution of the command will result in a conflict of an
existing reservation. UFS may support reserving areas of the device depending upon the device type and capabilities.
TASK SET FULL - This status is returned when the logical unit cannot process the command due to a lack of resources
such as task queue being full or memory needed for command execution is temporarily unavailable.
ACA ACTIVE - This status is returned when an ACA condition exists. See [SAM] for further definition.
TASK ABORTED - This status shall be returned when a command is aborted by a command or task management
function on another I_T nexus and the Control mode page TAS bit is set to one. Since in UFS there is only one I_T
nexus and TAS bit is zero TASK ABORTED status codes will never occur.
Page 76

1564 Device Information
1565 The Device Information field provides information at device level not necessarily related with the logical
1566 unit executing the command.
1567 In general, the information is about events that have an evolution much slower than the regular
1568 commands, and for which the host response latency is not critical. The use of this field avoids the
1569 execution of a continuous polling on some UFS attributes.
1570 Only bit 0 of the Device Information field is defined, all the others are reserved and shall be set to zero.
Bit Name Description
Exception Event Alert
bit 0 EVENT_ALERT 0b: All exception sources not active
1b: At least one exception source is active
Others Reserved
1571 The exception sources include: background operations, dynamic capacity, system data pool, etc. See
1572 13.4.11 “Exception Events Mechanism” for details.
1574 The Data Segment Length field will contain the number of valid bytes in the Data Segment.
1575 In the RESPONSE UPIU the Data Segment will contain the Sense Data bytes and the Sense Data Length
1576 field.
1577 When this field contains zero it indicates that there is no Data Segment area in the UPIU and therefore no
1578 Sense Data is returned.
1579 This version of the standard, when the Command Set Type field indicates SCSI Command Set, the
1580 number of Sense Data bytes is 18, therefore this field will contain a value of 20 (18 bytes of Sense Data +
1581 2 bytes for Sense Data Length = 20 bytes).
1582 As stated previously, the Data Segment field size will located on a 32-bit (DWORD) boundary. The Data
1583 Segment Length value indicated the number of “valid” bytes in the Data Segment area and therefore can
1584 be less than a multiple of 32-bits.
1585 Residual Transfer Count
1586 This field is valid only if one of the Flags.U or Flags.O fields are set to ‘1’, otherwise this field will
1587 contain zero.
1588 When the Flags.O field is set to ‘1’ then this field indicates the number of bytes that were not transferred
1589 from/to the Initiator because the Expected Data Transfer Length field contained a value that was lower
1590 than the Target expected to transfer. In other words, the Target has more bytes to receive/send to
1591 complete the request but the Initiator is not expecting more than the amount indicated in the Expected
1592 Data Transfer Length. For example, the Initiator may intentionally request less bytes than it knows the
1593 Target has available to transfer, because it only needs the first N bytes.
1594 When the Flags.U field is set to ‘1’ then this field indicates the number of bytes that were not transferred
1595 from/to the Initiator because the Expected Data Transfer Length field contained a value that was higher
1596 than the available data bytes. In other words, the Target has less bytes to receive/send than the Initiator is
1597 requesting to transfer. For example, the Initiator may intentionally request more bytes than the Target has
1598 to transfer when it does not know how many bytes the Target actually has and it asks for the max or more
1599 than possible.
Page 77

1601 Table 10.15 — Flags and Residual Count Relationship
Residual
Flags.O Flags.U Transfer Description
Count
0 0 0 Expected Data Length bytes transferred
1 0 N Target expected to send N more bytes to Initiator
0 1 N Initiator expected to receive N more bytes from Target
1 1 X Illegal condition
1602 Sense Data Fields

1603 The Sense Data fields will contain additional information on error condition.
1604 For SCSI command they will provide a copy of first 18 sense data bytes as defined for the fixed format
1605 sense data, which corresponds to Response Code value of 70h. See the following subsection for further
1606 details.
1607 A successfully executed command will not normally need to return Sense Data, therefore in this case the
1608 Data Segment may be empty and the Data Segment Length may have a zero value.
1609 The Sense Data fields will be padded with zeros to place the data on the next nearest 32-bit boundary if
1610 the length of valid Sense Data fields plus two is not a multiple of 32-bit.
1611 SCSI Sense Data Fields
1612 The Sense Data fields will contain standard 18 byte SPC defined sense data when using format for a
1613 Response Code value of 70h. See [SPC] for further information.
1614 Sense Data consists of three levels of error codes, each in increasing detail. The purpose is to provide
1615 the host a means to determine the cause of an error or exceptional condition at various levels of detail.
1616 The Sense Key provides a general category of what error or exceptional condition occurred and has
1617 caused the current command from successfully completing. Further and finer error detail is provided
1618 in the Additional Sense Code field (ASC). The Additional Sense Code Qualifier (ASCQ) field refines
1619 the error information even further. It is required to implement the Sense Key value when indicating
1620 an error or exceptional condition. It is not required to implement the ASC or ASCQ values not
1621 described in this document; a value of zero can be placed in these fields if the implementation does
1622 not require more refined error detail.
1623 All SCSI commands that terminate in error or exceptional condition will automatically return Sense
1624 Data in the RESPONSE UPIU, relieving the host from issuing a subsequent REQUEST SENSE
1625 command to retrieve the additional sense error information.
1626
Page 78

1628 Sense Data Length
1629 The Sense Data Length field indicates the number of valid Sense Data bytes that follow. The Sense Data
1630 Length plus two may be less than the number of bytes contained in the Data Segment area, if padding
1631 bytes have been added to reach 32-bit boundary.
1632 A successfully executed command will not normally need to return Sense Data, therefore in this case the
1633 Data Segment area may be empty and the Data Segment Length may have a zero value.
1634 A command that terminated in error or an exception may or may not return Sense Data. If the Sense Data
1635 Length indicates a value of zero, then that error condition did not return Sense Data. A zero value in the
1636 Data Segment Length also indicates that no Sense Data was returned. Otherwise, the Sense Data Length
1637 will contain a value that indicates the number of additional bytes of Sense Data information.
1638 SCSI Sense Data Length
1639 The Sense Data Length field shall indicate a value of 18 when using the SCSI Command Set.
1640 Sense Data Format
1641 The following table describes the sense data structure that gives detailed error information about the
1642 previously executed SCSI command. Eighteen bytes are returned and the Additional Sense Length field is
1643 set to a value of ten.
1644 ‘M’ indicates mandatory implementation of this field and the value specified if fixed. ‘O’ indicates that
1645 the support of this field is optional; if it is not supported then a value of zero should be inserted in the
1646 field otherwise the value will be indicated as described.
1647
Page 79

1649 Table 10.16 — SCSI Sense Data Format
Byte Bits Name Description Use
‘1’ if Information field is valid
7:7 Valid O
0 Default value = ‘0’
6:0 Response Code Value of 70h for standard sense data response M
Not used
1 7:0 Obsolete M
Default value = 00h
File mark found
7:7 FILEMARK M
Default value = 0b
End of media detected
6:6 EOM M
Default value = 0b
2 Incorrect length detected
5:5 ILI M
Default value = 0b
4:4 Reserved Default value = 0b M
Sense Key code is the general SCSI error code for
3:0 Sense Key M
previous command (see Table 10.17, SENSE KEY)
3:6 7:0 Information Sense Information O
Length in bytes of additional sense information
Additional Sense
7 7:0 Value = 10 (0Ah) indicating 10 additional bytes (bytes M
Length
8 through 17)
Command Specific Command Specific Information
8:11 7:0 M
Information Default value = “0”
Additional Sense Code is an additional, more specific
12 7:0 ASC M
error code (see [SPC] and [SBC])
Additional Sense Code Qualifier qualifies the
13 7:0 ASCQ M
Additional Sense Code (see [SPC] and [SBC])
Field replaceable unit code
14 7:0 FRUC M
Default value = 00h
Sense key specific information
15:17 7:0 Sense Key Specific M
Default value = 0000 0000h
1650
1651
Page 80

1653 Sense Key
1654 The Sense Key value provides a means to categorize errors and exceptional conditions. The Sense Key
1655 indicates a particular type of error. The Additional Sense Code and Additional Sense Code Qualifier can
1656 be used to further detail and describe the condition that the Sense Key indicates. Sense Keys are specific
1657 to the action performed by a particular command.
1658
1659 Table 10.17 — Sense Key
Sense Key
Value Description
NO SENSE – Indicates that there is no specific sense key information to be reported. This
00h
would be the result of a successfully executed command.
RECOVERED ERROR – Indicates that the last command completed successfully after error
01h recovery actions were performed by the target. Further detail may be determined by examining
the additional sense bytes (ASC and ASCQ fields).
02h NOT READY – Indicates that the logical unit addressed cannot be accessed at this time.
MEDIUM ERROR – Indicates that the last command was unsuccessful due to a non-
03h
recoverable error condition due to a flaw in the media or failed error recovery.
04h HARDWARE ERROR – Indicates that the target detected a non-recoverable hardware error.
ILLEGAL REQUEST – Indicates that there was an illegal parameter value in a command
descriptor block or within additional parameter data supplied with some commands. If the target
05h
detects an invalid parameter in the command descriptor block then it shall terminate the
command without altering the media.
UNIT ATTENTION – Indicates that the unit has been reset or unexpectedly powered-on or that
06h
removable media has changed.
DATA PROTECT – Indicates that a command that reads or writes the medium was attempted
07h on a block that is protected from this operation. The read or write operation shall not be
performed.
BLANK CHECK - Indicates that a target encountered blank or unformatted media while reading
08h
or writing.
VENDOR SPECIFIC – This Sense Key is available for reporting vendor specific error or
09h
exceptional conditions.
0Ah RESERVED
ABORTED COMMAND – Indicates that the target aborted the execution of the command. The
0Bh
initiator may be able to recover by retrying the command.
0Ch RESERVED
VOLUME OVERFLOW - Indicates that a buffered peripheral device has reached the end-of-
0Dh
partition and data may remain in the buffer that has not been written to the medium.
0Eh MISCOMPARE – Indicates that the source data did not match the data read from the media.
0Fh RESERVED
NOTE 1 See [SAM] for further details.
Page 81
1660 10.5.5 DATA OUT UPIU

1661 10.5.5.1 Overview
1662 The DATA OUT UPIU contains the basic UPIU header plus additional information needed to manage the
1663 data out transfer. The data transfer flows from Initiator to Target (write). The DATA OUT UPIU will
1664 usually contain a data segment. It is possible to have a null DATA OUT UPIU: the Data Segment is
1665 empty and Data Segment Length value is zero.
1666 The DATA OUT UPIU is sent in response to a Target generated READY TO TRANSFER UPIU.
1667 Table 10.18 — DATA OUT UPIU
DATA OUT UPIU
0 1 2 3
4 5 6 7
8 9 10 (MSB) 11 (LSB)
Total EHS Length (00h) Reserved Data Segment Length
12 (MSB) 13 14 15 (LSB)
Data Buffer Offset
16 (MSB) 17 18 19 (LSB)
Data Transfer Count
20 21 22 23
Reserved
24 25 26 27
Reserved
28 29 30 31
Reserved
k k+1 k+2 k+3
Data[0] Data[1] Data[2] Data[3]
… … … …
k+ Length-4 k+ Length-3 k+ Length-2 k+ Length-1
Data[Length - 4] Data[Length - 3] Data[Length - 2] Data[Length - 1]
NOTE 1 k = 32 if HD = 0
1668
1669
Page 82

1671 The first 12 bytes of the DATA OUT UPIU contain the Basic Header as described in 10.5.2 “Basic
1674 A type code value of 02h indicates a DATA OUT UPIU.
1676 The Data Segment Length shall indicate the number of valid bytes within the Data Segment area, and it
1677 shall not include the number of padding bytes (if present).
1678 Data Buffer Offset
1679 The Data Buffer Offset field contains the offset of this UPIU data payload within the complete data
1680 transfer area. The sum of the Data Buffer Offset and the Data Segment Length shall not exceed the
1681 Expected Transfer Length that was indicated in the COMMAND UPIU.
1682 This field permits out of order sequencing of the DATA OUT UPIU packets. Therefore the order of the
1683 DATA OUT UPIU packets do not have to be sequential.
1684 NOTE Out of order sequencing will only occur if a UFS device supports it (bDataOrdering = 01h) and if this
1685 feature is enabled (bOutOfOrderDataEn = 01h).
1686 Data Transfer Count
1687 This field indicates the number of bytes that the Initiator is transferring to the Target in this UPIU. This
1688 value is the number of bytes that are contained within the Data Segment of the UPIU. The maximum
1689 number of bytes that can be transferred within a single DATA OUT UPIU packet is 65535 bytes.
1690 Therefore, multiple DATA OUT UPIU packets will need to be issued by the Initiator if the Expected Data
1691 Transfer Length of the original command requires more than 65535 bytes to be transferred.
1692 This field and the Data Segment Length field of the UPIU shall contain the same value. This field is
1693 intended to be used along with the Data Buffer Offset field as part of a DMA context.
1694 Data Segment
1695 This is the Data Segment area that contains the data payload.
1696 The maximum data payload size that can be transferred within a single DATA OUT UPIU packet is
1697 65535 bytes.
1698 The Data Segment area always starts on a 32-bit (DWORD) boundary. The Data Segment area shall be
1699 entirely filled with data payload to a 32-bit (DWORD) boundary unless the UPIU is the one that transmits
1700 the last data portion. In this case, if necessary, the Data Segment area shall be padded out to the next
1701 nearest 32-bit boundary.
1702 NOTE For out of order DATA OUT UPIUs, the last data portion may not be transmitted by the final UPIU.
Page 83
1703 10.5.6 DATA IN UPIU

1704 10.5.6.1 Overview
1705 The DATA IN UPIU contains the basic UPIU header plus additional information needed to manage the
1706 data in transfer. Data in flows from Target to Initiator (READ). The DATA IN UPIU will usually contain
1707 a data segment. It is possible to have a null DATA IN UPIU: the Data Segment is empty and Data
1708 Segment Length is 0.
1709 Table 10.19 — SCSI Data IN UPIU
DATA IN UPIU
0 1 2 3
4 5 6 7
8 9 10 (MSB) 11 (LSB)
12 (MSB) 13 14 15 (LSB)
Data Buffer Offset
16 (MSB) 17 18 19 (LSB)
Data Transfer Count
20 21 22 23
Reserved
24 25 26 27
Reserved
28 29 30 31
Reserved
k k+1 k+2 k+3
… … … …
Data[Length -4] Data[Length -3] Data[Length -2] Data[Length -1]
NOTE 1 k = 32 if HD = 0.
1710
1711
Page 84
1712 10.5.6 DATA IN UPIU (cont’d)

1714 The first 12 bytes of the SCSI DATA IN UPIU contain the Basic Header as described in 10.5.2 “Basic
1717 A type code value of xx10 0010b indicates a DATA IN UPIU.
1719 The Data Segment Length shall indicate the number of valid bytes within the Data Segment area, and it
1720 shall not include the number of padding bytes (if present).
1722 The Data Buffer Offset field contains the offset of this UPIU data payload within the complete data
1723 transfer area. The sum of the Data Buffer Offset and the Data Segment Length shall not exceed the
1725 This field permits out of order sequencing of the DATA IN UPIU packets. Therefore the order of the
1726 SCSI In UPIU packets do not have to be sequential.
1727 NOTE Out of order sequencing will only occur if a UFS device supports it (bDataOrdering = 01h) and if this
1728 feature is enabled (bOutOfOrderDataEn = 01h).
1730 This field indicates the number of bytes that the Target has placed in the UPIU Data Segment, for transfer
1731 back to the Initiator. This value is the number of valid bytes that are contained within the Data Segment of
1732 this UPIU. The maximum number of bytes that can be transferred within a single DATA IN UPIU packet
1733 is 65535 bytes.
1734 This field and the Data Segment Length field of the UPIU shall contain the same value.
1735 Data Segment
1736 This is the Data Segment area that contains the data payload.
1737 The maximum data payload size that can be transferred within a single DATA IN UPIU packet is 65535
1738 bytes.
1739 The Data Segment area always starts on a 32-bit (DWORD) boundary. The Data Segment area shall be
1740 entirely filled with data payload to a 32-bit (DWORD) boundary unless the UPIU is the one that transmits
1741 the last data portion. In this case, if necessary, the Data Segment area shall be padded out to the next
1742 nearest 32-bit boundary.
1743 NOTE For out of order DATA IN UPIUs, the final data portion may not be transmitted by the last UPIU.
1744
Page 85
1745 10.5.7 READY TO TRANSFER UPIU

1746 10.5.7.1 Overview
1747 The READY TO TRANSFER UPIU is issued by the Target when it is ready to receive data blocks when
1748 processing a SCSI command that requires a data out transfer (write). The Target may request the data in
1749 sequence or out of order by setting the appropriate fields within the UPIU.
1750 The Initiator may respond to one or more READY TO TRANSFER UPIU packets with one or more
1751 DATA OUT UPIU packets, enough to satisfy the Expected Transfer Length that was indicated within the
1752 associated COMMAND UPIU. The maximum number of bytes that can be sent within a single DATA
1753 OUT UPIU packet is equal to bMaxDataOutSize attribute value.
1754 See 13.4.12 “Data transfer rules related with RTT (Ready-to-Transfer)” for further details about Initiator
1755 to Target data transfer.
1756 Table 10.20 — READY TO TRANSFER UPIU
Ready To Transfer UPIU
0 1 2 3
4 5 6 7
8 9 10 (MSB) 11 (LSB)
12 (MSB) 13 14 15 (LSB)
Data Buffer Offset
16 (MSB) 17 18 19 (LSB)
Data Transfer Count
20 21 22 23
Reserved
24 25 26 27
Reserved
28 29 30 31
Reserved
1757
1758
Page 86
1759 10.5.7 READY TO TRANSFER UPIU (cont’d)

1761 The first 12 bytes of the READY TO TRANSFER UPIU contain the Basic Header as described in 10.5.2
1762 “Basic Header Format”. Specific details follow below.
1764 A type code value of xx11 0001b indicates a READY TO TRANSFER UPIU.
1768 The Data Buffer Offset field indicates to the Initiator the location of the beginning of the segment of data
1769 to send. The Target may request the Initiator to transfer the data in a number of UPIUs, not necessarily in
1770 sequential order. The sum of the Data Buffer Offset and the Data Transfer Count should not exceed the
1772 The Data Buffer Offset shall be an integer multiple of four.
1774 This field indicates the number of bytes the Target is requesting.
1775 The Data Transfer Count field shall be always an integer multiple of four bytes except for RTT which
1776 requests the final portion of data in the transfer.
1777 The maximum number of bytes that can be requested in a single RTT is equal to bMaxDataOutSize
1778 attribute value.
1779
Page 87
1780 10.5.8 TASK MANAGEMENT REQUEST UPIU

1781 10.5.8.1 Overview
1782 The TASK MANAGEMENT REQUEST UPIU is used by the Initiator to manage the execution of one or
1783 more tasks within the Target. The Task Management Request function closely follows the SCSI
1784 Architecture Model [SAM].
1785 Table 10.21 — Task Management Request UPIU
TASK MANAGEMENT REQUEST UPIU
0 1 2 3
4 5 6 7
Reserved Task Manag. Function Reserved Reserved
8 9 10 (MSB) 11 (LSB)
12 (MSB) 13 14 15 (LSB)
Input Parameter 1
16 (MSB) 17 18 19 (LSB)
Input Parameter 2
20 (MSB) 21 22 23 (LSB)
Input Parameter 3
24 25 26 27
Reserved
28 29 30 31
Reserved
1786
1787
Page 88
1788 10.5.8 TASK MANAGEMENT REQUEST UPIU (cont’d)

1790 The first 12 bytes of the TASK MANAGEMENT REQUEST UPIU contain the Basic Header as
1791 described in 10.5.2 “Basic Header Format”. Specific details follow.
1793 A type code value of xx00 0100b indicates a TASK MANAGEMENT REQUEST UPIU.
1794 Task Management Function
1795 Table 10.22 defines UFS Task Management Functions based on [SAM].
1796 Table 10.22 — Task Management Function values
Function Value Description
Abort specific task in queue in a specific LU.
Abort Task 01h
Identify by LUN and Task Tag
Abort Task Set 02h Abort the task queue list in a specific LU. Identify by LUN.
Clear the task queue list in specific LU. Identify by LUN. Equivalent
Clear Task Set 04h
to Abort Task Set.
Logical Unit Reset 08h Reset the designated LU. Identify by LUN
Query a specific task in a queue list in a specific LU. Identify by
LUN and Task Tag. If the specific task is present in the queue,
Query Task 80h Function Succeeded is returned in the response. If the specific task
is not present in the queue, Function Complete is returned in the
response.
Query a specific LU to see if there is any Task in queue. Identify by
LUN. If there is one of more tasks present in the queue, Function
Query Task Set 81h
Succeeded is returned in the response. If no task is present in the
queue, Function Complete is returned in the response.
1797 Task Management Input Parameters

1798 Table 10.23 — Task Management Input Parameters
Field Description
LSB: LUN of the logical unit operated on by the task management function.
Input Parameter 1
Other bytes: Reserved
LSB: Task Tag of the task/command operated by the task management function.
Input Parameter 2
Input Parameter 3 Reserved
1799 Input Parameter 1 and LUN field in the basic header should be set to the same value.
1800
Page 89
1801 10.5.9 TASK MANAGEMENT RESPONSE UPIU

1802 10.5.9.1 Overview
1803 The TASK MANAGEMENT RESPONSE UPIU is sent by the Target in response to a Task Management
1804 Request from the Initiator. The Task Management Response function closely follows the SCSI
1805 Architecture Model [SAM].
1806 Table 10.24 — Task Management Response UPIU
TASK MANAGEMENT RESPONSE UPIU
0 1 2 3
4 5 6 7
Reserved Reserved Response Reserved
8 9 10 (MSB) 11 (LSB)
12 (MSB) 13 14 15 (LSB)
Output Parameter 1
16 (MSB) 17 18 19 (LSB)
Output Parameter 2
20 21 22 23
Reserved
24 25 26 27
Reserved
28 29 30 31
Reserved
1807
1808
Page 90
1809 10.5.9 TASK MANAGEMENT RESPONSE UPIU (cont’d)

1811 The first 12 bytes of the TASK MANAGEMENT RESPONSE UPIU contain the Basic Header as
1812 described in 10.5.2 “Basic Header Format”. Specific details follow.
1814 A type code value of xx10 0100b indicates a TASK MANAGEMENT RESPONSE UPIU.
1815 Response
1816 The Response field contains the UFS response that indicates the success or failure of the Task
1817 Management Request. See 10.5.2 for details.
1818 Task Management Output Parameters
1819 Table 10.25 — Task Management Output Parameters
Field Description
LSB: Task Management Service Response (see Table 10.26)

Output Parameter 1
Output Parameter 2 Reserved
1820
1821 Task Management Service Response
1822 Table 10.26 — Task Management Service Response
Service Response Value
Task Management Function Complete 00h
Task Management Function Not Supported 04h
Task Management Function Failed 05h
Task Management Function Succeeded 08h
Incorrect Logical Unit Number 09h

1823
Page 91
1824 10.5.10 QUERY REQUEST UPIU

1825 The QUERY REQUEST UPIU is used to transfer data between the Initiator and Target that is outside
1826 domain of standard user data transfers for command read and write.
1827 The QUERY REQUEST UPIU can be used to read and write parametric data to or from the Target. It can
1828 be used to get information for configuration or enumeration, to set or clear bus or overall device
1829 conditions, to set or reset global flag values, parameters or attributes, to set or get power or bus or
1830 network information or to get or set descriptors, to get serial numbers or GUID’s (globally unique
1831 identifiers), etc.
1832 The Target will send a QUERY RESPONSE UPIU in response to a QUERY REQUEST UPIU. After
1833 sending a QUERY REQUEST UPIU the Initiator shall not send a new QUERY REQUEST UPIU until it
1834 receives the QUERY RESPONSE UPIU for the pending request. If the Target receives a QUERY
1835 REQUEST UPIU while it is still processing a previous QUERY REQUEST UPIU, it shall ignore the
1836 latest request.
1837 The QUERY REQUEST UPIU follows the general UPIU format with a field defined for query function.
1838 The Transaction Specific Fields are defined specifically for each type of operations.
1839 The Data Segment Area is optional depending upon the query function value. The Data Segment Length
1840 field will be set to zero if there is no data segment in the packet.
1841 Table 10.27 — QUERY REQUEST UPIU
QUERY REQUEST UPIU
0 1 2 3
xx01 0110b Flags Reserved Task Tag
4 5 6 7
Reserved Query Function Reserved Reserved
8 9 10 (MSB) 11 (LSB)
12 13 14 15
Transaction Specific Fields
16 17 18 19
20 21 22 23
24 25 26 27
28 29 30 31
Reserved
k k+1 k+2 k+3
… … … …
Page 92
1842 10.5.10 QUERY REQUEST UPIU (cont’d)

1843 10.5.10.1 Overview
1844 Queries are used to read and write data structures between the host and the device. This data is outside the
1845 scope of normal device reads or writes; data that would be considered system data, configuration data,
1846 production information, descriptors, special parameters and flags and other.
1847 For UFS the query function will generally be used to read or write Descriptors, Attributes and Flags.
1848 There are also a range of Vendor Specific operations that can be used to transfer vendor specific data
1849 between host and device.
1850 All these items reside within the device memory and used by the device to control or define its operation.
1851 Below is a short overview of the most common data structures that are transferred using the Query
1852 Request function. Please see the related section for more detail on these data structures.
1853 Descriptors
1854 A Descriptor is a block or page of parameters that describe something about a Device. For example, there
1855 are Device Descriptors, Configuration Descriptors, Unit Descriptors, etc.
1856 Attributes
1857 An Attribute is a single parameter that represents a specific range of numeric values that can be set or
1858 read. This value could be a byte or word or floating point number. For example, baud rate or block size
1859 would be an attribute. Attribute size can be from 1-bit to 32-bit. Attributes of the same type can be
1860 organized in arrays, each element of them identified by an index.
1861 Flags
1862 A Flag is a single Boolean value that represents a TRUE or FALSE, ‘0’ or ‘1’, ON or OFF type of value.
1863 A Flag can be cleared or reset, set, toggled or read. Flags are useful to enable or disable certain functions
1864 or modes or states within the device.
1865
1866
Page 93

1868 10.5.10.2 Query Function
1869 The Query Function field holds the requested query type describing the query function to perform.
1870 Common query functions are listed in Table 10.28. Currently, there are two general query functions
1871 defined: Read Request and Write Request. Additional Transaction Specific Fields will be used to specify
1872 further information needed for the transaction. These fields can describe the specific operation to perform,
1873 the target data or information to access, the amount of data to transfer and additional parameters and data.
1874 Table 10.28 — Query Function field values
QUERY FUNCTION
00h Reserved
01h STANDARD READ REQUEST
02h-3Fh Reserved
40-7Fh Vendor Specific Read Functions
80h Reserved
81h STANDARD WRITE REQUEST
82h-BFh Reserved
C0h-FFh Vendor Specific Write Functions
1875 Standard Read Request

1876 The Standard Read Request function type is used to read requested information from a Target device. The
1877 Target device will return the requested information to the Initiator within a QUERY RESPONSE UPIU
1878 packet.
1879 Standard Write Request
1880 The Standard Write Request function type is used to write information and data to a Target device. The
1881 information and data to write to the Target will be included within the Data Segment field of the QUERY
1882 REQUEST UPIU packet.
1883
Page 94

1885 10.5.10.3 Transaction Specific Fields
1886 The transaction specific fields are defined specifically for each type of operations which are defined by
1887 the OPCODE field. For the STANDARD READ REQUEST and STANDARD WRITE REQUEST the
1888 fields are defined as in Table 10.29.
1889
1890 Table 10.29 — Transaction specific fields
Transaction Specific Fields for Standard Read/Write Request
12 13 14 15
OPCODE OSF[0] OSF[1] OSF[2]
16 17 18 (MSB) 19 (LSB)
OSF[3] OSF[4] OSF[5]
20 (MSB) 21 22 23 (LSB)
OSF[6]
24 (MSB) 25 26 27 (LSB)
OSF[7]
1891 OPCODE
1892 The opcode indicates the operation to perform. Possible opcode values are listed in Table 10.30.
1893 Table 10.30 — Query Function opcode values
OPCODE
00h NOP
01h READ DESCRIPTOR
WRITE
02h
DESCRIPTOR
03h READ ATTRIBUTE
04h WRITE ATTRIBUTE
05h READ FLAG
06h SET FLAG
07h CLEAR FLAG
08h TOGGLE FLAG
09h-EFh Reserved
F0h-FFh Vendor Specific
1894 OSF
1895 The OSF field is an Opcode Specific Field. The OSF fields will be defined for each specific OPCODE.
1896
Page 95

1898 10.5.10.4 Read Descriptor Opcode
1899 The READ DESCRIPTOR OPCODE is used to retrieve a UFS Descriptor from the Target device. A
1900 descriptor can be a fixed or variable length. There are up to 256 possible descriptor types. The OSF fields
1901 are used to select a particular descriptor and to read a number of descriptor bytes. The OSF fields are
1902 defined as listed in Table 10.31.
1903 Table 10.31 — Read descriptor
Transaction Specific Fields for READ DESCRIPTOR OPCODE
12 13 14 15
01h DESCRIPTOR IDN INDEX SELECTOR
16 17 18 (MSB) 19 (LSB)
Reserved Reserved LENGTH
20 21 22 23
Reserved
24 25 26 27
Reserved
1904
1905 DESCRIPTOR IDN
1906 The Descriptor IDN field contains a value that indicates the particular type of descriptor to retrieve. For
1907 example, it could indicate a Device Descriptor or Unit Descriptor or String Descriptor. Some descriptor
1908 types are unique and can be fully identified by the Descriptor Type value. Other descriptors can exist in
1909 multiple forms, such as String Descriptors, and must be furthered identified with subsequent fields.
1910 INDEX
1911 The Index value is used to further identify a particular descriptor. For example, there may be multiple
1912 String Descriptors defined. In the case of multiple descriptors the INDEX field is used to select a
1913 particular one. Multiple descriptors are indexed starting from 0 through 255. The actual index value for a
1914 particular descriptor will be provided by other means, usually contained within a field of some other
1915 related descriptor.
1916 SELECTOR
1917 The SELECTOR field may be needed to further identify a particular descriptor. In most cases this value is
1918 0.
1919 LENGTH
1920 The LENGTH field is used to indicate the number of bytes to read of the descriptor. These bytes will be
1921 returned in a QUERY RESPONSE UPIU packet. This is the requested length to read, which may be less
1922 than, or equal to, or greater than the number of bytes within the actual descriptor. If less than, or equal to
1923 the actual descriptor size, the number of bytes specified will be returned. If the LENGTH is greater than
1924 the descriptor size, the response will provide the exact descriptor size in the LENGTH field of the
1925 QUERY RESPONSE UPIU .
1926
Page 96

1928 10.5.10.5 Write Descriptor Opcode
1929 The WRITE DESCRIPTOR OPCODE is used to write a UFS Descriptor from the Host to the Target
1930 device. A descriptor can be a fixed or variable length. There are up to 256 possible descriptor types. The
1931 OSF fields are used to select a particular descriptor. The OSF fields are defined as listed in Table 10.32.
1932 Table 10.32 — Write Descriptor
Transaction Specific Fields for WRITE DESCRIPTOR OPCODE
12 13 14 15
16 17 18 (MSB) 19 (LSB)
20 21 22 23
Reserved
24 25 26 27
Reserved
1933
1934 DESCRIPTOR IDN
1935 The Descriptor IDN field contains a value that identifies a particular of descriptor to write. For example,
1936 it could indicate a Device Descriptor or Unit Descriptor or String Descriptor. Some descriptor types are
1937 unique and can be fully identified by the Descriptor IDN value. Other descriptors can exist in multiple
1938 forms, such as STRING DESCRIPTORS, and must be furthered identified with subsequent fields.
1939 INDEX
1940 The Index value is used to further identify a particular descriptor. For example, there may be multiple
1941 String Descriptors defined. In the case of multiple descriptors the INDEX field is used to select a
1942 particular one. Multiple descriptors are indexed starting from 0 through 255. The actual index value for a
1943 particular descriptor will be provided by other means, usually contained within a field of some other
1944 related descriptor.
1945 SELECTOR
1946 The SELECTOR field may be needed to further identify a particular descriptor. In most cases this value is
1947 0.
1948 LENGTH
1949 The LENGTH field is used to indicate the number of descriptor bytes to write. The entire descriptor must
1950 be written; there is no partial write or update possible. These bytes will be contained within the DATA
1951 SEGMENT area of the QUERY REQUEST UPIU packet. The DATA SEGMENT LENGTH field of the
1952 UPIU shall also be set to this same value. If LENGTH is not equal to the descriptor size the operation will
1953 fail: the descriptor is not updated and the Query Response field of the QUERY RESPONSE UPIU is set
1954 FAILURE.
Page 97

1956 10.5.10.6 Read Attribute Opcode
1957 The READ ATTRIBUTE OPCODE is used to retrieve a UFS Attribute from the Target device. Attribute
1958 size can be from 1-bit to 32-bit. There are up to 256 possible Attributes, identified by an identification
1959 number, IDN, which ranges from 0 to 255. The OSF fields for this opcode are listed in Table 10.33.
1960 Table 10.33 — Read Attribute
Transaction Specific Fields for READ ATTRIBUTE OPCODE
12 13 14 15
03h ATTRIBUTE IDN INDEX SELECTOR
16 17 18 19
20 21 22 23
Reserved
24 25 26 27
Reserved
1961
1962 ATTRIBUTE IDN
1963 The ATTRIBUTE IDN contains a value that identifies a particular Attribute to retrieve from the Target
1964 device.
1965 INDEX
1966 For attributes that are organized in array, the index value is used to identify the particular element. For
1967 example, the LUN is used as index to select the particular element of attributes that have logical unit
1968 specific values.
1969 The range for the index is defined for each attribute, and it can be from 0 through 255. Index shall be set
1970 to zero for attributes composed by single element.
1971 SELECTOR
1972 The SELECTOR field may be needed to further identify a particular element of an attribute. Selector field
1973 shall be set to zero for attributes that do not require it.
1974
Page 98

1976 10.5.10.7 Write Attribute Opcode
1977 The WRITE ATTRIBUTE OPCODE is used to write a UFS Attribute to the Target device. Attribute
1978 size can be from 1-bit to 32-bit. There are up to 256 possible Attributes, identified by an identification
1979 number, IDN, which ranges from 0 to 255. The OSF fields for this opcode are listed in Table 10.34
1980 Table 10.34 — Write Attribute
Transaction Specific Fields for WRITE ATTRIBUTE OPCODE
12 13 14 15
16 17 18 19
20 (MSB) 21 22 23 (LSB)
VALUE [31:24] VALUE [23:16] VALUE [15:8] VALUE [7:0]
24 25 26 27
Reserved
1981 ATTRIBUTE IDN

1982 The ATTRIBUTE IDN contains a value that identifies a particular Attribute to write in the Target device.
1983 INDEX
1984 For attributes that are organized in array, the index value is used to identify the particular element. For
1985 example, the LUN is used as index to select the particular element of attributes that have logical unit
1986 specific values.
1987 The range for the index is defined for each attribute, and it can be from 0 through 255. Index shall be set
1988 to zero for attributes composed by single element.
1989 SELECTOR
1990 The SELECTOR field may be needed to further identify a particular element of an attribute. Selector field
1991 shall be set to zero for attributes that do not require it.
1992 VALUE [31:0]
1993 The 32-bit VALUE field contains the data value of the Attribute. The VALUE is a right justified, big
1994 Endian value. Unused upper bits shall be set to zero.
1995
Page 99

1997 10.5.10.8 Read Flag Opcode
1998 The READ FLAG OPCODE is used to retrieve a UFS Flag value from the Target device. A Flag is a
1999 fixed size single byte value that represents a Boolean value. There can be defined up to 256 possible Flag
2000 values. A Flag is identified by its FLAG IDN, an identification number that ranges in value from 0 to 255.
2001 The OSF fields for this opcode are listed in Table 10.35.
2002 The FLAG data, either one (01h) or zero (00h), is returned within the Transaction Specific Fields area of
2003 a QUERY RESPONSE UPIU packet.
2004 Table 10.35 — Read Flag
Transaction Specific Fields for READ FLAG OPCODE
12 13 14 15
05h FLAG IDN INDEX SELECTOR
16 17 18 19
20 21 22 23
Reserved
24 25 26 27
Reserved
2005 FLAG IDN

2006 The FLAG IDN field contains a value that identifies a particular Flag to retrieve from the Target device.
2007 INDEX
2008 The index field may be needed to identify a particular element of a flag. Index field is not used in this
2009 version of the standard and its value shall be zero.
2010 SELECTOR
2011 The selector field may be needed to further identify a particular element of a flag. Selector field is not
2012 used in this version of the standard and its value shall be zero.
2013 Operation
2014 The Boolean value of the addressed flag is returned in a QUERY RESPONSE UPIU.
2015
Page 100

2017 10.5.10.9 Set Flag
2018 Table 10.36 — Set Flag
Transaction Specific Fields for SET FLAG OPCODE
12 13 14 15
16 17 18 19
20 21 22 23
Reserved
24 25 26 27
Reserved
2019
2020 FLAG IDN
2021 The FLAG IDN field contains a value that identifies a particular Flag to set in the Target device.
2022 Operation
2023 The Boolean value of the addressed flag is set to TRUE or one.
2024 INDEX
2027 SELECTOR
2030
Page 101

2032 10.5.10.10 Clear Flag
2033 Table 10.37 — Clear Flag
Transaction Specific Fields for CLEAR FLAG OPCODE
12 13 14 15

16 17 18 19
20 21 22 23
Reserved
24 25 26 27
Reserved
2034 FLAG IDN

2035 The FLAG IDN field contains a value that identifies a particular Flag to clear in Target device.
2036 INDEX
2039 SELECTOR
2042 Operation
2043 The Boolean value of the addressed flag is cleared to FALSE or zero.
2044
Page 102

2046 10.5.10.11 Toggle Flag
2047 Table 10.38 — Toggle Flag
Transaction Specific Fields for TOGGLE FLAG OPCODE
12 13 14 15
16 17 18 19
20 21 22 23
Reserved
24 25 26 27
Reserved
2048 FLAG IDN

2049 The FLAG IDN field contains a value that identifies a particular Flag to toggle in the Target device.
2050 INDEX
2053 SELECTOR
2056 OPERATION
2057 The Boolean value of the addressed flag is set to the negated current value.
2058
Page 103

2060 10.5.10.12 NOP
2061 Table 10.39 defines NOP OPCODE for QUERY REQUEST UPIU.
2062 Table 10.39 — NOP
Transaction Specific Fields for NOP FLAG OPCODE
12 13 14 15
00h Reserved Reserved Reserved
16 17 18 19
20 21 22 23
Reserved
24 25 26 27
Reserved
2063
Page 104
2064 10.5.11 QUERY RESPONSE UPIU

2065 The QUERY RESPONSE UPIU is used to transfer data between the Target and Initiator in response to a
2066 QUERY REQUEST UPIU.
2067 The QUERY RESPONSE UPIU is used to return parametric data to the requesting Initiator in case of
2068 read descriptor/attribute/flag query request, or to provide response to write descriptor/attribute query
2069 request or set/clear/toggle flag query request.
2070 Table 10.40 — QUERY RESPONSE
QUERY RESPONSE UPIU
0 1 2 3
4 5 6 7
Reserved Query Function Query Response Reserved
8 9 10 (MSB) 11 (LSB)
Total EHS Length (00h) Device Information Data Segment Length
12 13 14 15
16 17 18 19
20 21 22 23
24 25 26 27
28 29 30 31
Reserved
k k+1 k+2 k+3
… … … …
2071 The QUERY RESPONSE UPIU follows the general UPIU format a field defined for query function.
2072 The transaction specific fields are defined specifically for each type of operations.
2073 The Data Segment Area is optional depending upon the Query Function value. The Data Segment Length
2074 field will be set to zero if there is no data segment in the packet.
2075
Page 105
2076 10.5.11 QUERY RESPONSE UPIU (cont’d)

2077 10.5.11.1 Overview
2078 The Query Response function will respond to the query function that was sent from the Initiator in the
2079 QUERY REQUEST UPIU. The Query Response may or may not return data depending upon the
2080 function. If data needs to be returned it will be returned in the Data Segment of the UPIU or one of the
2081 Transaction Specific Fields.
2082 10.5.11.2 Query Function
2083 The Query Function field will contain the original query function value that was sent in the corresponding
2085 10.5.11.3 Query Response
2086 The Query Response field indicates the completion code of the action taken in response to the QUERY
2087 REQUEST UPIU. Possible values are listed in Table 10.41.
2088 NOTE In case of unsuccessful operation, the Target may either set Query Response field to FFh, or optionally
2089 provide more detailed information about the failure using one of the other values.
2090 Table 10.41 — Query Response Code
Value Description
00h Success
01h-F5h Reserved
F6h Parameter not readable
F7h Parameter not writeable

(1)
F8h Parameter already written
F9h Invalid LENGTH

(2)
FAh Invalid value
FBh Invalid SELECTOR
FCh Invalid INDEX
FDh Invalid IDN
FEh Invalid OPCODE
FFh General failure
NOTE 1 This value applies to parameters with “Write once” or

“Power on reset” write access property.
NOTE 2 This value applies to the following operations: write
descriptor, write attribute, set flag, clear flag.
2091
Page 106

2093 10.5.11.4 Device Information
2094 See Device Information field definition in RESPONSE UPIU, 10.5.4.2 “Basic Header”.
2095 10.5.11.5 Transaction Specific Fields
2096 The transaction specific fields are defined specifically for each type of operations which are defined byte the
2097 OPCODE field. For the STANDARD READ REQUEST and STANDARD WRITE REQUEST the fields are
2098 defined as in Table 10.42.
2099 Table 10.42 — Transaction Specific Fields
Transaction Specific Fields for Standard Read/Write Request
12 13 14 15
OPCODE OSF[0] OSF[1] OSF[2]
16 17 18 (MSB) 19 (LSB)
OSF[3] OSF[4] OSF[5]
20 (MSB) 21 22 23 (LSB)
OSF[6]
24 (MSB) 25 26 27 (LSB)
OSF[7]
2100 OPCODE
2101 The opcode indicates the operation to perform. Possible opcode values are listed in Table 10.43.
2102 Table 10.43 — Query Function opcode values
OPCODE
00h NOP
01h READ DESCRIPTOR
02h WRITE DESCRIPTOR
03h READ ATTRIBUTE
04h WRITE ATTRIBUTE
05h READ FLAG
06h SET FLAG
07h CLEAR FLAG
08h TOGGLE FLAG
09h-EFh Reserved
F0h-FFh Vendor Specific
2103 If in a QUERY REQUEST UPIU, the Query Function field is set to STANDARD READ REQUEST and the
2104 OPCODE field is set to WRITE DESCRIPTOR, WRITE ATTRIBUTE, SET FLAG, CLEAR FLAG, or TOGGLE
2105 FLAG; then the query request shall fail and the Query Response field shall be set to either “Invalid OPCODE” or
2106 “General failure”.
2107 If in a QUERY REQUEST UPIU, the Query Function field is set to STANDARD WRITE REQUEST and the
2108 OPCODE field is set to READ DESCRIPTOR, READ ATTRIBUTE, or READ FLAG; then the query request shall
2109 fail and the Query Response field shall be set to either “Invalid OPCODE” or “General failure”.
2110 If in a QUERY REQUEST UPIU, the Query Function opcode field is set to a reserved value, the same value shall be
2111 returned in the QUERY RESPONSE UPIU.
2112 OSF
2113 The OSF field is an Opcode Specific Field. The OSF fields will be defined for each specific OPCODE.
Page 107

2115 10.5.11.6 Read Descriptor Opcode
2116 The READ DESCRIPTOR OPCODE is used to retrieve a UFS DESCRIPTOR from the Target device. A
2117 descriptor can be a fixed or variable length. There are up to 256 possible descriptor types. The OSF fields
2118 are used to select a particular descriptor and to read a number of descriptor bytes. The OSF fields are
2119 defined as listed in Table 10.44.
2120 The READ DESCRIPTOR OPCODE is returned in response to a QUERY REQUEST UPIU containing
2121 the same value in the OPCODE field.
2122 Table 10.44 — Read Descriptor
Transaction Specific Fields for READ DESCRIPTOR OPCODE
12 13 14 15
16 17 18 (MSB) 19 (LSB)
20 21 22 23
Reserved
24 25 26 27
Reserved
2123 DESCRIPTOR IDN

2124 The DESCRIPTOR IDN field contains the same DESCRIPTOR IDN value sent from the corresponding
2126 INDEX
2127 The Index field value returned is the same INDEX value of the corresponding QUERY REQUEST UPIU.
2128 SELECTOR
2129 The SELECTOR field returned is the same SELECTOR value of the corresponding QUERY REQUEST
2130 UPIU.
2131 LENGTH
2132 The LENGTH field is used to indicate the number of bytes returned in response to the corresponding
2133 QUERY RESPONSE UPIU. This value could be less than the requested size if the size of the data item is
2134 smaller than the size requested in the corresponding QUERY REQUEST UPIU.
2135
Page 108

2137 10.5.11.7 Write Descriptor Opcode
2138 The WRITE DESCRIPTOR OPCODE is used to respond to a write descriptor query request. A descriptor
2139 can be a fixed or variable length. There are up to 256 possible descriptor types. The OSF fields are used to
2140 select a particular descriptor. The OSF fields are defined as listed in the following table.
2141 Table 10.45 — Write Descriptor
Transaction Specific Fields for WRITE DESCRIPTOR OPCODE
12 13 14 15
16 17 18 (MSB) 19 (LSB)
20 21 22 23
Reserved
24 25 26 27
Reserved
2142
2143 DESCRIPTOR IDN
2144 The Descriptor IDN field contains the same DESCRIPTOR IDN value sent from the corresponding
2146 INDEX
2148 SELECTOR
2150 UPIU.
2151 LENGTH
2152 The LENGTH field is used to indicate the number of descriptor bytes written. The entire descriptor must
2153 be written; there is no partial write or update possible.
2154
2155
Page 109

2157 10.5.11.8 Read Attribute Opcode
2158 The READ ATTRIBUTE OPCODE is used to retrieve an UFS attribute from the Target device. Attribute
2159 size can be from 1-bit to 32-bit. There are up to 256 possible attributes, identified by an identification
2160 number, IDN, which ranges from 0 to 255.
2161 The response to a READ ATTRIBUTE request will be returned in a QUERY RESPONSE UPIU. A
2162 success or failure code for the entire operation will be contained within the RESPONSE field.
2163 The attribute data will be returned within the transaction specific fields. The Transaction Specific fields
2164 are formatted as indicated in Table 10.46. The first two 32-bits words of those fields will echo the first
2165 two 32-bit words of the transaction specific fields of the QUERY REQUEST UPIU. The third word will
2166 contain the Attribute data.
2167 Table 10.46 — Read Attribute Response Data Format
Transaction Specific Fields for READ ATTRIBUTE OPCODE
12 13 14 15
16 17 18 19
20 (MSB) 21 22 23 (LSB)
24 25 26 27
Reserved
2168 ATTRIBUTE IDN

2169 The ATTRIBUTE IDN field contains the same ATTRIBUTE IDN value sent from the corresponding
2171 INDEX
2173 SELECTOR
2175 UPIU.
2176 VALUE [31:0]
2177 The 32-bit VALUE field contains the data value of the ATTRIBUTE. The VALUE is a right justified, big
2178 Endian value. Unused upper bits shall be set to zero.
Page 110

2180 10.5.11.9 Write Attribute Opcode
2181 The WRITE ATTRIBUTE OPCODE is used to respond to a write attribute query request. Attribute size
2182 can be from 1-bit to 32-bit. There are up to 256 possible attributes, identified by an identification number,
2183 IDN, which ranges from 0 to 255. The OSF fields for this opcode are listed in Table 10.47
2184 Table 10.47 — Write Attribute
Transaction Specific Fields for WRITE ATTRIBUTE OPCODE
12 13 14 15
16 17 18 19
20 (MSB) 21 22 23 (LSB)
24 25 26 27
Reserved
2185 ATTRIBUTE IDN

2186 The ATTRIBUTE IDN field contains the same ATTRIBUTE IDN value sent from the corresponding
2188 INDEX
2190 SELECTOR
2192 UPIU.
2193 VALUE [31:0]
2194 The 32-bit VALUE field contains the data value of the attribute provided in the write attribute query
2195 request.
2196
2197
Page 111

2199 10.5.11.10 Read Flag Opcode
2200 The READ FLAG OPCODE is used to retrieve a UFS FLAG value from the Target device. An FLAG is
2201 a fixed size single byte value that represents a Boolean value. There can be defined up to 256 possible
2202 FLAG values. A FLAG is identified by its FLAG IDN, an identification number that ranges in value from
2203 0 to 255. The FLAG data, either ‘1’ or ‘0’, is returned within the Transaction Specific Fields area of a
2204 QUERY RESPONSE UPIU packet.
2205 The response to a READ ATTRIBUTE request will be returned in a QUERY RESPONSE UPIU. A
2206 success or failure code for the entire operation will be contained within the RESPONSE field.
2207 The attribute data will be returned within the transaction specific fields. The Transaction Specific fields
2208 are formatted as indicated in Table 10.48. The first two 32-bits words of those fields will echo the first
2209 two 32-bit words of the transaction specific fields of the QUERY REQUEST UPIU. The third word will
2210 contain the FLAG data, a ‘0’ or ‘1’ value.
2211 Table 10.48 — Read Flag Response Data Format
Transaction Specific Fields for READ FLAG OPCODE
12 13 14 15
16 17 18 19
20 21 22 23
Reserved Reserved Reserved FLAG VALUE
24 25 26 27
Reserved
2212 FLAG IDN

2213 The FLAG IDN field contains the same FLAG IDN value sent from the corresponding QUERY
2214 REQUEST UPIU
2215 INDEX
2217 SELECTOR
2219 UPIU
2220 FLAG VALUE
2221 The FLAG VALUE field contains the FLAG data: 00h or 01h.
Page 112

2223 10.5.11.11 Set Flag
2224 Table 10.49 — Set Flag
Transaction Specific Fields for SET FLAG OPCODE
12 13 14 15
16 17 18 19
20 21 22 23
24 25 26 27
Reserved
2225 FLAG IDN

2227 REQUEST UPIU
2228 INDEX
2230 SELECTOR
2232 UPIU.
2233 FLAG VALUE
2235
Page 113

2237 10.5.11.12 Clear Flag
2238 Table 10.50 — Clear Flag
Transaction Specific Fields for CLEAR FLAG OPCODE
12 13 14 15
16 17 18 19
20 21 22 23
24 25 26 27
Reserved
2239 FLAG IDN

2241 REQUEST UPIU
2242 INDEX
2244 SELECTOR
2246 UPIU.
2247 FLAG VALUE
2249
Page 114

2251 10.5.11.13 Toggle Flag
2252 Table 10.51 — Toggle Flag
Transaction Specific Fields for TOGGLE FLAG OPCODE
12 13 14 15
16 17 18 19
20 21 22 23
24 25 26 27
Reserved
2253 FLAG IDN

2255 REQUEST UPIU.
2256 INDEX
2258 SELECTOR
2260 UPIU
2261 FLAG VALUE
2263
Page 115

2265 10.5.11.14 NOP
2266 Table 10.52 defines NOP OPCODE for QUERY RESPONSE UPIU.
2267 Table 10.52 — NOP
Transaction Specific Fields for NOP FLAG OPCODE
12 13 14 15
00h Reserved Reserved Reserved
16 17 18 19
20 21 22 23
Reserved
24 25 26 27
Reserved
2268
Page 116
2269 10.5.12 REJECT UPIU

2270 10.5.12.1 Overview
2271 All UPIU packets include the basic header segment and some transaction specific fields. In addition to
2272 them, UPIU packets may have: Data Segment, Extra Header Segment, Header E2ECRC, Data E2ECRC.
2273 The purpose of the REJECT UPIU is to simplify the software development and the system debug.
2274 Table 10.53 — Reject UPIU
Reject UPIU
0 1 2 3
4 5 6 7
Reserved Reserved Response (01h) Reserved
8 9 10 (MSB) 11 (LSB)
Total EHS Length Device Information
Data Segment Length (0000h)
(00h) (00h)
12 13 14 15
Basic Header Status Reserved E2E Status Reserved
16 17 18 19
Reserved
20 21 22 23
Reserved
24 25 26 27
Reserved
28 29 30 31
Reserved
2275 The device shall send a REJECT UPIU if it receives an UPIU with an invalid Transaction Type.
2276 The Transaction Type is defined in 10.5.2 “Basic Header Format” and it is composed by the following
2277 fields: HD bit, DD bit and the Transaction Code.
2278 Since this version of the specification does not support end-to-end CRC for header and data segments, a
2279 Transaction Type value is valid if
2280 • HD bit and DD bit are set to zero
2281 • the Transaction Code identifies one of the defined UPIU transactions from the Initiator to Target,
2282 see Table 10.1 “UPIU Transaction Codes” (reserved values excluded).
2283 The device shall not respond with a REJECT UPIU in the following cases.
2284 • Incorrect LUN field or Command Set Type field in a COMMAND UPIU: the device shall send a
2285 RESPONSE UPIU. In particular, in case of an incorrect Command Set Type field value, the Data
2286 Segment Area of the RESPONSE UPIU shall be empty (Data Segment Length shall be equal to
2287 zero).
2288 • Incorrect LUN field or Task Management Function field in TASK MANAGEMENT REQUEST
2289 UPIU: the device shall send a TASK MANAGEMENT RESPONSE UPIU.
2290 • Incorrect Query Function field in QUERY REQUEST UPIU: the device shall send a QUERY
2291 RESPONSE UPIU
Page 117

2293 The first 12 bytes of the Reject UPIU contain the Basic Header as described in 10.5.2 “Basic Header
2294 Format”. Specific details follow.
2296 A type code value of xx11 1111b indicates a Reject UPIU.
2297 Flags
2298 The Flags field value shall be equal to zero.
2299 LUN
2300 The LUN shall be equal to the LUN value of the rejected UPIU.
2301 Task Tag
2302 The Task Tag shall be equal to the Task Tag value of the rejected UPIU.
2303 Response
2304 The Response field shall be set to 01h (Target Failure) indicating that the Target was not able the execute
2305 the requested operation.
2308 Basic Header Status
2309 The Basic Header Status field provides information about error detected in the UPIU received by the
2310 Initiator.
2311 Table 10.54 defines the possible values for the Basic Header Status field.
2312 Table 10.54 — Basic Header Status Description
Value Name
00h Reserved
01h Invalid Transaction Type
02h to FFh Reserved
2313 E2E Status

2314 The E2E Status field provides the result of the end-to-end CRC of the rejected UPIU for both Header and
2315 Data. E2E Status is reserved if end-to-end CRC is not supported.
2316
2317 Table 10.55 — E2E Status Definition
Bit Description
0: Header E2ECRC validated or not supported
Bit 0
1: Header E2ECRC error
0: Data E2ECRC validated or not supported
Bit 1
1: Data E2ECRC error
Others Reserved
Page 118
2318 10.5.13 NOP OUT UPIU

2319 10.5.13.1 Overview
2320 The Initiator may use NOP OUT UPIU to check the connection to a device. The Target will respond to a
2321 NOP OUT UPIU sending a NOP IN UPIU back to the Initiator.
2322
2323 Table 10.56 — NOP OUT UPIU
NOP OUT UPIU
0 1 2 3
4 5 6 7
8 9 10 (MSB) 11 (LSB)
Total EHS Length

Reserved Data Segment Length (0000h)
(00h)
12 13 14 15
Reserved
16 17 18 19
Reserved
20 21 22 23
Reserved
24 25 26 27
Reserved
28 29 30 31
Reserved
32 (MSB) 33 34 35 (LSB)
2324
2325
Page 119

2327 The first 12 bytes of the NOP OUT UPIU contain the Basic Header as described in section
2328 10.5.2 “Basic Header Format”. Specific details follow below.
2329 Task Tag
2330 Task Tag normally is related to I_T_L_Q nexus addressing of SCSI while here it is used in a pure UTP
2331 (device level) context.
2333 A type code value of xx00 00000b indicates a NOP OUT UPIU.
2334 Flags
2338
Page 120
2339 10.5.14 NOP IN UPIU

2340 10.5.14.1 Overview
2341 NOP IN UPIU is the Target response to a NOP OUT UPIU sent by the Initiator.
2342 Table 10.57 — NOP IN UPIU
NOP IN UPIU
0 1 2 3
4 5 6 7
Reserved Reserved Response (00h) Reserved
8 9 10 (MSB) 11 (LSB)
Total EHS Length Device Information

Data Segment Length (0000h)
(00h) (00h)
12 13 14 15
Reserved
16 17 18 19
Reserved
20 21 22 23
Reserved
24 25 26 27
Reserved
28 29 30 31
Reserved
32 (MSB) 33 34 35 (LSB)
2343
2344
Page 121

2346 The first 12 bytes of the NOP IN UPIU contain the Basic Header as described in 10.5.2 “Basic Header
2347 Format”. Specific details follow.
2349 A type code value of xx10 00000b indicates a NOP IN UPIU.
2350 Flags
2352 Task Tag
2353 The Task Tag shall be equal to the Task Tag value of the corresponding NOP OUT UPIU.
2354 Response
2355 The Response field shall be set to 00h (Target Success) indicating that the Target was able to respond to
2356 the NOP OUT UPIU.
2359
2360
Page 122
2361 10.6 Logical Units

2363 This section gives more details on the definition of logical unit in the UFS Standard.
2364 10.6.2 UFS SCSI Domain
HOST DEVICE (Client) UFS DEVICE (Server)

SCSI Initiator SCSI Target
Logical Unit
Application Client Device
Server LUN
Task Resources under the
Task control of Logical Unit
Manager (memory area, etc.)
1 … M Application Clients
per Host
1 … N Logical Units
per Device
UniPro Port UniPro Port
2365
2366 Figure 10.1 — UFS SCSI domain
2367 10.6.3 UFS Logical Unit Definition
2368 A Logical Unit (LU) is an externally addressable, independent, processing entity that processes SCSI
2369 tasks (commands) and performs task management functions.
2370  A UFS device contains 1 or more logical units
2371  Each logical unit is independent of other logical units in a device
2372  UFS shall support up to eight logical units for boot code, application code and mass storage data
2373 applications, in addition to the well-known logical units as defined in 10.6.6 of this specification.
2374 Commands addressed to logical unit ‘i’ are handled by logical unit ‘i’ exclusively, not visible, handled or
2375 processed by logical unit ‘j’ (or any other LU)
2376 A logical unit contains the followings:
2377  DEVICE SERVER: A conceptual object within a logical unit that processes SCSI commands.
2378  TASK MANAGER: A conceptual object within a logical unit that controls the sequencing of
2379 commands and performs task management functions.
2380  TASK SET: A conceptual group of 1 or more commands (a list, queue, etc.)
2381
Page 123
2382 10.6.4 Well-Known Logical Unit Definition

2383 Well known logical units, as defined by SCSI, support very specific types of commands, usually only four
2384 or five commands such as REPORT LUNS command to allow an application client to issue requests to
2385 receive specific information usually relating to the entire device.
2386 In this standard, additional well known logical units are defined for specific UFS functions, including
2387 Boot and RPMB. Each well known logical unit has a well known logical unit number (W-LUN).
2388 10.6.5 Logical Unit Addressing
2389 The 8-bit LUN field in UPIU is used to provide either LUN or W-LUN. In particular, the most significant
2390 bit of this field (WLUN_ID) shall be set according to the logical unit type as follows:
2391  WLUN_ID = 0b for logical unit,
2392  WLUN_ID = 1b for well known logical unit.
2393 The remaining 7 bits of the LUN field (UNIT_NUMBER_ID) shall be set to either the LUN value or the
2394 W-LUN value, depending on the logical unit type.
2395
2396
2397 LUN Field in UPIU
2398 7 6 5 4 3 2 1 0
2399
WLUN_ID UNIT_NUMBER_ID
2400
2401 WLUN_ID specifies whether an logical unit or a well known logical unit is being addressed:
2402 - a value of zero indicates a logical unit is being addressed,
2403 - a value of one indicates an well known logical unit is being addressed.
2404 UNIT_NUMBER_ID specifies the unit number (LUN or W-LUN)
2405
2406
2407 Figure 10.2 — Logical Unit Addressing
2408 Therefore, the encoding of the LUN field in UPIU supports up to 128 LUN’s and up to 128 W-LUN’s
2409 (0 <= UNIT_NUMBER_ID <= 127) .
2410
Page 124
2411 10.6.6 Well Known Logical Unit Defined in UFS

2412 The following well known logical units are defined in this standard for SCSI and UFS specific functions:
2413 REPORT LUNS, UFS Device, Boot, RPMB.
2414 The REPORT LUNS well known logical unit is defined in [SPC] and provides the logical unit inventory.
2415 The UFS Device well known logical unit provides UFS device level interaction (i.e., Power mode
2416 control). The Boot well known logical unit is a virtual reference to the actual logical unit containing boot
2417 code, as designated by the host. The Boot well known logical unit is read at the system startup to access
2418 the boot code. The RPMB well known logical unit supports the RPMB function with its own independent
2419 processes and memory space as dictated by the RPMB security definition.
2420 Each well known logical unit shall only process the commands listed in Table 10.58. If a command is
2421 received by a well known logical unit that is not listed in Table 10.58, then the command shall be
2422 terminated with CHECK CONDITION status, with the sense key set to ILLEGAL REQUEST, and the
2423 additional sense code set to INVALID COMMAND OPERATION CODE.
2424 Table 10.58 — Well known logical unit commands
LUN Field
Well known logical unit W-LUN Command name
in UPIU
INQUIRY, REQUEST SENSE,

REPORT LUNS 01h 81h
TEST UNIT READY, REPORT LUNS

UFS Device 50h D0h
TEST UNIT READY, START STOP UNIT

Boot 30h B0h TEST UNIT READY,
READ (6), READ (10), READ (16)
INQUIRY,REQUEST SENSE,
RPMB 44h C4h TEST UNIT READY,
SECURITY IN, SECURITY OUT
2425 NOTE If bBootEnable field in the Device Descriptor is set to zero, the Boot well known logical unit may
2426 terminate TEST UNIT READY, READ (6), READ (10), and READ (16) commands with CHECK CONDITION
2427 status.
Page 125
2428 10.6.7 Translation of 8-bit UFS LUN to 64-bit SCSI LUN Address
2429 The SCSI Architecture Model describes a 64-bit LUN addressing scheme. The value of C1h in the first 8
2430 bits of the 64-bit address indicates a well known LUN address in the SAM SCSI format. Examples of
2431 translation of the 8-bit LUN field value in UPIU to 64-bit SCSI address are shown in Table 10.59.
2432
2433 Table 10.59 — Examples of logical unit representation format
Logical unit
Logical Unit Name LUN field in UPIU LUN SAM LUN
Logical Unit 1 01h 01h 00 01 00 00 00 00 00 00h
Logical Unit 6 06h 06h 00 06 00 00 00 00 00 00h
Well known logical unit
Logical Unit Name LUN field in UPIU W-LUN SAM LUN
Boot B0h 30h C1 30 00 00 00 00 00 00h
RPMB C4h 44h C1 44 00 00 00 00 00 00h
2434
2435
Page 126
2436 10.6.8 SCSI Write Command

2437 The execution of a SCSI write command is composed by the following subsequent phases: command,
2438 data, status. In the command phase a write command is sent to the device using COMMAND UPIU.
2439 During the subsequent phase data is delivered to the UFS device using DATA OUT UPIU: the UFS
2440 device pace the data delivery by sending a READY TO TRANSFER UPIU when it is ready for the next
2441 DATA OUT UPIU. (The UFS device may send new READY TO TRANSFER UPIU’s before it receives
2442 data for previous request.)
2443 The write command terminates with a RESPONSE UPIU that contains the status.
2444 Figure 10.3 shows an example of UPIU sequence for SCSI write command.
COMMAND UPIU
(WRITE CDB)
RTT UPIU
(DMA CONTEXT)
DATA OUT UPIU

(WRITE DATA)
...
TIME
RTT UPIU
(DMA CONTEXT)
DATA OUT UPIU

(WRITE DATA)
RESPONSE UPIU
(STATUS INFO)
2445
2446 Figure 10.3 — SCSI Write
Page 127
2447 10.6.9 SCSI Read Command

2448 The execution of a SCSI read command is composed by the following subsequent phases: command,
2449 data, status. In the command phase a read command is sent to the device using COMMAND UPIU.
2450 During the subsequent phase the UFS device delivers data to the host using DATA IN UPIU. The read
2451 command terminates with a RESPONSE UPIU that contains the status.
2452 Figure 10.4 shows an example of UPIU sequence for SCSI read command.
COMMAND UPIU
(READ CDB)
DATA IN UPIU
(READ DATA)
...
TIME
DATA IN UPIU
(READ DATA)
RESPONSE UPIU
(STATUS INFO)
2453
2454 Figure 10.4 — SCSI Read
2455
Page 128
2456 10.7 Application Layer and Device Manager Transport Protocol Services
2457 10.7.1 UFS Initiator Port and Target Port Attributes
2458
2459 Table 10.60 — UFS Initiator Port and Target Port Attributes
Attribute Value
Maximum CDB Length 16 bytes
Command Identifier Size 16 bits
Simple, Head of Queue, Ordered, ACA (not
Task Attributes Supported
supported)
Maximum Data-In Buffer Size FFFFh
Maximum Data-Out Buffer Size FFFFh
Maximum CRN Not Applicable
Command Priority Supported No
Maximum Sense Data Length FFFFh
Status Qualifier Supported No
Additional Response Information Supported Yes
Bidirectional Commands Supported No
Abort Task, Abort Task Set, Clear Task Set,
Task Management Functions Supported
Logical Unit Reset, Query Task, Query Task Set
2460
2461 10.7.2 Execute Command procedure call transport protocol services
2462 All SCSI transport protocol standards shall define the SCSI transport protocol specific requirements for
2463 implementing the Send SCSI Command request, the SCSI Command Received indication, the Send
2464 Command Complete response, and the Command Complete Received confirmation SCSI transport
2465 protocol services.
2466 All SCSI initiator devices shall implement the Send SCSI Command request and the Command Complete
2467 Received confirmation SCSI transport protocol services as defined in the applicable SCSI transport
2468 protocol standards. All SCSI target devices shall implement the SCSI Command Received indication and
2469 the Send Command Complete response SCSI transport protocol services as defined in the applicable
2470 SCSI transport protocol standards.
2471
Initiator Target
Send SCSI Command request SCSI Command Received indication
Command Complete Received confirmation Send Command Complete response

2472
2473
Page 129
2474
2475
2476 Figure 10-5: Command w/o Data Phase
Page 130
2477 10.7.3 Send SCSI Command transport protocol service

2478 An application client uses the Send Command transport protocol service request to request a UFS Initiator
2479 port transmit a COMMAND UPIU via UniPort
2480  Send SCSI Command (IN (I_T_L_Q Nexus, CDB, Task Attribute, [Data-in Buffer Size], [Data-out
2481 Buffer], [Data-out Buffer Size], [CRN], [Command Priority], [First Burst Enabled]))
2482
2483 Table 10.61 — Send SCSI Command transport protocol service
Argument Implementation
I specifies the initiator port to send the COMMAND UPIU

T specifies the target port to which the COMMAND UPIU is to be sent
I_T_L_Q Nexus
L specifies the LUN field in the COMMAND UPIU
Q specifies the Task Tag field in the COMMAND UPIU
CDB Specifies the CDB field in the COMMAND UPIU
Task Attribute Specifies the Flags.ATTR of the Flag field in the COMMAND UPIU
[Data-in Buffer Size] Expected Data Transfer Length
[Data-out Buffer] Internal to UFS Initiator port
[Data-out Buffer Size] Expected Data Transfer Length
[CRN] Reserved
[Command Priority] Ignored
An argument specifying that a SCSI transport protocol specific number of

bytes from the Data-Out Buffer shall be delivered to the logical unit
without waiting for the device server to invoke the Receive Data-Out SCSI
[First Burst Enabled] transport protocol service.
A non‐zero value in the Data Segment Length field indicates First Burst
Enabled.
2484
2485
Page 131
2486 10.7.4 SCSI Command Received transport protocol

2487 A UFS target port uses the SCSI Command Received transport protocol service indication to notify a task
2488 manager that it has received a COMMAND UPIU.
2489  SCSI Command Received (IN (I_T_L_Q Nexus, CDB, Task Attribute, [CRN], [Command Priority],
2490 [First Burst Enabled))
2491
2492 Table 10.62 — SCSI Command Received transport protocol
I indicates the initiator port from which COMMAND UPIU was

received
I_T_L_Q Nexus T indicates the target port which receives the COMMAND UPIU
L indicates the LUN field in the COMMAND UPIU
Q indicates the Task Tag field in the COMMAND UPIU
CDB Specifies the CDB field in the COMMAND UPIU
Task Attribute Specifies the Flags.ATTR of the Flag field in the COMMAND UPIU
[CRN] Reserved
[Command Priority] Ignored
An argument specifying that a SCSI transport protocol specific

number of bytes from the Data-Out Buffer shall be delivered to the
logical unit without waiting for the device server to invoke the
[First Burst Enabled] Receive Data-Out SCSI transport protocol service.
A non‐zero value in the Data Segment Length field indicates First
Burst Enabled.
2493
Page 132
2494 10.7.5 Send Command Complete transport protocol service

2495 A device server uses the Send Command Complete transport protocol service response to request that a
2496 UFS target port transmit a RESPONSE UPIU.
2497  Send Command Complete (IN (I_T_L_Q Nexus, [Sense Data], [Sense Data Length], Status, [Status
2498 Qualifier], Service Response))
2499 A device server shall only call Send Command Complete () after receiving SCSI Command Received ().
2500 A device server shall not call Send Command Complete () for a given I_T_L_Q nexus until:
2501 a) all its outstanding Receive Data-Out () calls for that I_T_L_Q nexus have been responded to with
2502 Data-Out Received (); and
2503 b) all its outstanding Send Data-In () calls for that I_T_L_Q nexus have been responded to with
2504 Data-In Delivered ().
2505
2506 Table 10.63 — Send Command Complete transport protocol service
I specifies the initiator port to send the RESPONSE UPIU

T specifies the target port to which the RESPONSE UPIU is to be sent
I_T_L_Q Nexus
L specifies the LUN field in the RESPONSE UPIU
Q specifies the Task Tag field in the RESPONSE UPIU
[Sense Data] Specifies the Sense Data field in the RESPONSE UPIU
[Send Data Length] Specifies the Sense Data Length field in the RESPONSE UPIU
Status Specifies the Status Length field in the RESPONSE UPIU
[Status Qualifier] Ignored
Service Response Specifies the Response field in the RESPONSE UPIU
2507
2508
Page 133
2509 10.7.6 Command Complete Received transport protocol service

2510 A UFS initiator port uses the Command Complete Received transport protocol service confirmation to
2511 notify an application client that it has received a response for its COMMAND UPIU.
2512  Command Complete Received (IN (I_T_L_Q Nexus, [Data-in Buffer], [Sense Data], [Sense Data
2513 Length], Status, [Status Qualifier], Service Response))
2514 Table 10.64 — Command Complete Received transport protocol service
I specifies the initiator port to send the RESPONSE UPIU

T specifies the target port to which the RESPONSE UPIU is to be sent
I_T_L_Q Nexus
L specifies the LUN field in the RESPONSE UPIU
Q specifies the Task Tag field in the RESPONSE UPIU
A buffer containing command specific information returned by the

[Data-in Buffer]
logical unit on command completion
[Sense Data] Specifies the Sense Data field in the RESPONSE UPIU
[Send Data Length] Specifies the Sense Data Length field in the RESPONSE UPIU
Status Specifies the Status Length field in the RESPONSE UPIU
[Status Qualifier] Ignored
Service Response Specifies the Response field in the RESPONSE UPIU
2515
2516 10.7.7 Data transfer SCSI transport protocol services
2517 The data transfer services provide mechanisms for moving data to and from the SCSI initiator port while
2518 processing commands. All SCSI transport protocol standards shall define the protocols required to
2519 implement these services.
2520 The application client's Data-In Buffer and/or Data-Out Buffer each appears to the device server as a
2521 single, logically contiguous block of memory large enough to hold all the data required by the command.
2522
Page 134
2523 10.7.7.1 Send Data-In transport protocol service

2524 A device server uses the Send Data-In transport protocol service request to request that a UFS target port
2525 sends data.
2526  Send Data-In (IN (I_T_L_Q Nexus, Device Server Buffer, Application Client Buffer Offset,
2527 Request Byte Count))
2528 A device server shall only call Send Data-In () during a read operation.
2529 A device server shall not call Send Data-In () for a given I_T_L_Q nexus after it has called Send
2530 Command Complete () for that I_T_L_Q nexus (e.g., a RESPONSE UPIU with for that I_T_L_Q nexus)
2531 or called Task Management Function Executed for a task management function that terminates that task
2532 (e.g., an ABORT TASK).
2533 Table 10.65 — Send Data-In transport protocol service
I_T_L_Q Nexus I_T_L_Q of the corresponding COMMAND UPIU
Device Server Buffer Internal to device server
Offset in bytes from the beginning of the application client's buffer to
Application Client Buffer Offset
the first byte of transferred data.
Request Byte Count Specifies the length of the read data specified by the command
2534
2535 10.7.7.2 Data-In Delivered transport protocol service
2536 This confirmation notifies the device server that the specified data was successfully delivered to the
2537 application client buffer, or that a UniPro delivery subsystem error occurred while attempting to deliver
2538 the data.
2539  Data-In Delivered (IN (I_T_L_Q Nexus, Delivery Result))
2540 Table 10.66 — Data-In Delivered transport protocol service
DELIVERY SUCCESSFUL: The data was delivered successfully.
Delivery Result DELIVERY FAILURE: A UTP service delivery error occurred while
attempting to deliver the data.
2541
Page 135
2542
2543 Figure 10.6 — Command + Read Data Phase 1/2
2544
Page 136
2545
2546
2547 Figure 10.7 — Command + Read Data Phase 2/2
Page 137
2548 10.7.7.3 Receive Data-Out transport protocol service

2549 A device server uses the Receive Data-Out transport protocol service request to request that a UFS target
2550 port receives data
2551  Receive Data-Out (IN (I_T_L_Q Nexus, Application Client Buffer Offset, Request Byte Count,
2552 Device Server Buffer))
2553 A device server shall only call Receive Data-Out () during a write operation.
2554 A device server shall not call Receive Data-Out () for a given I_T_L_Q nexus after a Send Command
2555 Complete () has been called for that I_T_L_Q nexus or after a Task Management Function Executed ()
2556 has been called for a task management function that terminates that command (e.g., an ABORT TASK).
2557 Table 10.67 — Receive Data-Out transport protocol service
Offset in bytes from the beginning of the application client's buffer to

Application Client Buffer Offset
the first byte of transferred data
Device Server Buffer Internal to device server
Request Byte Count Number of bytes to be moved by this request
2558 10.7.7.4 Data-Out Received transport protocol service

2559 A UFS target port uses the Data-Out Received transport protocol service indication to notify a device
2560 server that it has received data.
2561  Data-out Received (IN (I_T_L_Q Nexus, Delivery Result))
2562 Table 10.68 — Data-Out Received transport protocol service
DELIVERY SUCCESSFUL: The data was delivered successfully.

Delivery Result DELIVERY FAILURE: A UTP service delivery error occurred while
attempting to deliver the data.
2563
Page 138
2564
2565 Figure 10.8 — Command + Write Data Phase 1/2
2566
2567
2568
Page 139
2569
2570 Figure 10.9 — Command + Write Data Phase 2/2
2571
Page 140
2572 10.7.8 Task Management Function procedure calls

2573 An application client requests the processing of a task management function by invoking the SCSI
2574 transport protocol services:
2575  Service Response = Function name (IN (Nexus), OUT ([Additional Response Information])
2576 Table 10.69 — Task Management Function procedure calls
Task Management Function (Function name) Nexus argument
Abort Task I_T_L_Q Nexus
Abort Task Set I_T_L Nexus
Clear Task Set I_T_L Nexus
Logical Unit Reset I_T_L Nexus
Query Task I_T_L_Q Nexus
Query Task Set I_T_L Nexus
2577 One of the following SCSI transport protocol specific service responses shall be returned:
2578 Table 10.70 — SCSI transport protocol service responses
A task manager response indicating that the requested function is
complete.
FUNCTION COMPLETE Unless another response is required, the task manager shall return
this response upon completion of a task management request
supported by the logical unit or SCSI target device to which the
request was directed.
A task manager response indicating that the requested function is
supported and completed successfully. This task manager response
FUNCTION SUCCEEDED
shall only be used by functions that require notification of success
(e.g., QUERY TASK, QUERY TASK SET)
A task manager response indicating that the requested function is not
FUNCTION REJECTED supported by the logical unit or SCSI target device to which the
function was directed.
INCORRECT LOGICAL UNIT A task router response indicating that the function requested
NUMBER processing for an incorrect logical unit number.
The request was terminated due to a service delivery failure
SERVICE DELIVERY OR
TARGET FAILURE SCSI target device malfunction. The task manager may or may not
have successfully performed the specified function.
2579
2580
Page 141
2581 10.7.8.1 ABORT TASK

2582 This function shall be supported by all logical units.
2583 The task manager shall abort the specified command, if it exists. Previously established conditions,
2584 including mode parameters, and reservations shall not be changed by the ABORT TASK function.
2585 A response of FUNCTION COMPLETE shall indicate that the command was aborted or was not in the
2586 task set. In either case, the SCSI target device shall guarantee that no further requests or responses are
2587 sent from the command.
2588 All SCSI transport protocol standards shall support the ABORT TASK task management function.
2589 Service Response = ABORT TASK (IN ( I_T_L_Q Nexus ))
2590 10.7.8.2 ABORT TASK SET

2592 The task manager shall abort all commands in the task set that were received on the specified I_T_L
2593 nexus. Commands received on other I_T nexuses or in other task sets shall not be aborted. This task
2594 management function performed is equivalent to a series of ABORT TASK requests.
2595 All pending status and sense data for the commands that were aborted shall be cleared. Other previously
2596 established conditions, including mode parameters, and reservations shall not be changed by the ABORT
2597 TASK SET function.
2598 All SCSI transport protocol standards shall support the ABORT TASK SET task management function.
2599 Service Response = ABORT TASK SET (IN ( I_T_L Nexus ))
2600 10.7.8.3 CLEAR TASK SET

2602 The task manager shall abort all commands in the task set. If the TST field is set to 001b (i.e., per I_T
2603 nexus) in the Control mode page (see [SPC]), there is one task set per I_T nexus. As a result, no other I_T
2604 nexuses are affected and CLEAR TASK SET is equivalent to ABORT TASK SET.
2605 All pending status and sense data for the task set shall be cleared. Other previously established conditions,
2606 including mode parameters, and reservations shall not be changed by the CLEAR TASK SET function.
2607 All SCSI transport protocol standards shall support the CLEAR TASK SET task management function.
2608 Service Response = CLEAR TASK SET (IN ( I_T_L Nexus ))
2609 10.7.8.4 LOGICAL UNIT RESET

2611 Before returning a FUNCTION COMPLETE response, the logical unit shall perform the logical unit reset
2612 functions.
2613 All SCSI transport protocol standards shall support the LOGICAL UNIT RESET task management
2614 function.
2615 Service Response = LOGICAL UNIT RESET (IN ( I_T_L Nexus ))
Page 142
2616 10.7.8.5 QUERY TASK

2617 UFS transport protocols shall support QUERY TASK.
2618 The task manager in the specified logical unit shall:
2619 1) If the specified command is present in the task set, then return a service response set to FUNCTION
2620 SUCCEEDED; or
2621 2) If the specified command is not present in the task set, then return a service response set to
2622 FUNCTION COMPLETE.
2623 Service Response = QUERY TASK (IN ( I_T_L_Q Nexus ))
2624 10.7.8.6 QUERY TASK SET

2625 UFS transport protocols shall support QUERY TASK SET.
2626 The task manager in the specified logical unit shall:
2627 1. If there is any command present in the task set specified I_T_L nexus, then return a service response
2628 set to FUNCTION SUCCEEDED; or
2629 2. If there is no command present in the task set specified I_T nexus, then return a service response set to
2630 FUNCTION COMPLETE.
2631 Service Response = QUERY TASK SET (IN ( I_T_L Nexus ))
2632 10.7.8.7 Task Management SCSI Transport Protocol Services

2633 UFS standard shall define the SCSI transport protocol specific requirements for implementing the Send
2634 Task Management Request request, the Task Management Request Received indication, the Task
2635 Management Function Executed response, and the Received Task Management Function Executed
2636 confirmation SCSI transport protocol services.
2637 A SCSI transport protocol standard may specify different implementation requirements for the Send Task
2638 Management Request request SCSI transport protocol service for different values of the Function
2639 Identifier argument.
2640 All SCSI initiator devices shall implement the Send Task Management Request request and the Received
2641 Task Management Function Executed confirmation SCSI transport protocol services as defined in the
2642 applicable SCSI transport protocol standards.
2643 All SCSI target devices shall implement the Task Management Request Received indication and the Task
2644 Management Function Executed response SCSI transport protocol services as defined in the applicable
2645 SCSI transport protocol standards.
2646
Page 143
2647
2648 Figure 10.10 — Task Management Function
Page 144
2649 10.7.8.8 Send Task Management Request SCSI transport protocol service request
2650 An application client uses the Send Task Management Request SCSI transport protocol service request to
2651 request that a SCSI initiator port send a task management function.
2652 Send Task Management Request SCSI transport protocol service request:
2653 Send Task Management Request (IN ( Nexus, Function Identifier ))
2654 Table 10.71 — Send Task Management Request SCSI transport protocol service request
Nexus I_T nexus, I_T_L nexus, or I_T_L_Q nexus
Function Identifier: Argument encoding the task management function to be performed.
2655 10.7.8.9 Task Management Request Received SCSI transport protocol service indication
2656 A task router uses the Task Management Request Received SCSI transport protocol service indication to
2657 notify a task manager that it has received a task management function.
2658 Task Management Request Received SCSI transport protocol service indication:
2659 Task Management Request Received (IN ( Nexus, Function Identifier ))
2660 Table 10.72 — Task Management Request Received SCSI transport protocol service indication
Function Identifier: Argument encoding the task management function to be performed.
2661 10.7.8.10 Task Management Function Executed SCSI transport protocol service response
2662 A task manager uses the Task Management Function Executed SCSI transport protocol service response
2663 to request that a SCSI target port transmit task management function executed information.
2664 Task Management Function Executed SCSI transport protocol service response:
2665 Task Management Function Executed (IN ( Nexus, Service Response, [Additional Response Information]
2666 ))
2667 Table 10.73 — Task Management Function Executed SCSI transport protocol service response
FUNCTION COMPLETE
FUNCTION SUCCEEDED:
Service Response FUNCTION REJECTED
INCORRECT LOGICAL UNIT NUMBER
SERVICE DELIVERY OR TARGET FAILURE
Additional Response The Additional Response Information output argument for the task
Information management procedure call
Page 145
2668 10.7.8.11 Received Task Management Function Executed SCSI transport protocol service
2669 confirmation
2670 A SCSI initiator port uses the Received Task Management Function Executed SCSI transport protocol
2671 service confirmation to notify an application client that it has received task management function
2672 executed information.
2673 Received Task Management Function Executed SCSI transport protocol service confirmation:
2674 Received Task Management Function Executed (IN ( Nexus, Service Response, [Additional Response
2675 Information] ))
2676 Table 10.74 — Received Task Management Function Executed SCSI transport protocol service
2677 confirmation
FUNCTION COMPLETE
FUNCTION SUCCEEDED:
Service Response FUNCTION REJECTED
INCORRECT LOGICAL UNIT NUMBER
SERVICE DELIVERY OR TARGET FAILURE
Additional Response The Additional Response Information output argument for the task management
Information procedure call
2678 10.7.9 Query Function transport protocol services

2679 UFS defines Query Function to get/set UFS-specific device-level registers and parameters (not part of
2680 SCSI definition).
2681 10.7.9.1 Send Query Request UFS transport protocol service

2682 An application client uses the Send Query Request UFS transport protocol service request to request that
2683 a UFS initiator port send a Query Request function.
2684 Send Query Request UFS transport protocol service request:
2685 Send Query Request(I_T Nexus, Operation: Read|Write, Type: UFS|Vendor, Identifier:
2686 Descriptor|Attribute|Flag,Length: n, [Index], [Selector], [WriteData])
2687 Table 10.75 — Send Query Request UFS transport protocol service
Nexus I_T nexus
Operation Argument encoding the operation to be performed
Type Indicates UFS defined or vendor-specific operation
Identifier Identifier for descriptor type, attribute or flag
Length Number of bytes to read or write
Index Index reference for the descriptor, attribute or flag
Selector Reserved
WriteData Data to be written in a write query request
Page 146
2688
2689 Figure 10.11 — UFS Query Function
Page 147
2690 10.7.9.2 Query Request Received UFS transport protocol service indication
2691 A UFS target port uses the Query Request Received UFS transport protocol service indication to notify a
2692 UFS device manager that it has received a query function.
2693 Query Request Received UFS transport protocol service indication:
2694 Query Request Received(I_T Nexus, Operation: Read|Write, Type: UFS|Vendor,
2695 Identifier:Descriptor|Attribute|Flag,Length:n, [Index], [Selector], [WriteData])
2696 Table 10.76 — Query Request Received UFS transport protocol service indication
Nexus I_T nexus
Operation Argument encoding the operation to be performed
Type Indicates UFS defined or vendor-specific operation
Identifier Identifier for descriptor type, attribute or flag
Length Number of bytes to read or write
Index Index reference for the descriptor, attribute or flag
Selector Reserved
WriteData Data to be written in a write query request
2697 10.7.9.3 Query Function Executed UFS transport protocol service response
2698 A device manager uses the Query Function Executed UFS transport protocol service response to request
2699 that a UFS target port transmit query function executed information.
2700 Query Function Executed UFS transport protocol service response:
2701 Query Executed(I_T Nexus, Service Response,[ReadData])
2702
2703 Table 10.77 — Query Function Executed UFS transport protocol service response
Nexus I_T nexus
FUNCTION SUCCEEDED
Service Response
FUNCTION FAILED
ReadData Data to be returned in a read query request
2704
2705
Page 148
2706 10.7.9.4 Received Query Function Executed UFS transport protocol service confirmation
2707 A UFS initiator port uses the Received Query Function Executed UFS transport protocol service
2708 confirmation to notify an application client that it has received task management function executed
2709 information.
2710 Received Query Function Executed UFS transport protocol service confirmation:
2711 Received Query Executed(I_T Nexus, Service Response,[ReadData])
2712
2713 Table 10.78 — Received Query Function Executed UFS transport protocol service confirmation
Nexus I_T nexus
FUNCTION SUCCEEDED
Service Response
FUNCTION FAILED
ReadData Data to be returned in a read query request
2714
2715
Page 149
2716 11 UFS PROTOCOL LAYER – SCSI COMMANDS
2717 11.1 Universal Flash Storage Command Layer (UCL) Introduction

2718 This chapter defines the mandatory SCSI commands set supported by the UFS device. The commands
2719 are based on UFS Native Commands and SCSI Primary Commands ‐4 [SPC] / SCSI Block Commands -3
2720 [SBC].
2721 The UFS native commands (UNC) set is defined by JEDEC to support flash storage and UFS native basic
2722 needs. The UFS SCSI commands set (USC) consists of a selection of commands from SCSI Primary
2723 Commands – 4 [SPC], and SCSI Block Commands – 3 [SBC]. Both command types share similar
2724 command descriptor block (CDB) format.
2725
UFS Native UFS SCSI

Future expansion…
command set commands set
( SPC-2, SBC-3 )
UFS Transport Protocol layer
UFS Interconnects layer

(MIPI UniPro and M-PHY)
2726
2727 Figure 11.1 — UFS Command Layer
2728 11.1.1 The Command Descriptor Block (CDB)
2729 SCSI commands are communicated by sending the SCSI Command Descriptor Block (CDB) to the
2730 device. There are only fixed length CDB format for UFS, unlike SCSI which has additional Variable
2731 Length CDB format.
2732 All UFS CDBs shall have an OPERATION CODE field as their first byte and these values shall be
2733 defined by each SCSI and UFS. Detail SCSI CDB usages and structure are defined in SPC‐4, 4.3 “The
2734 Command Descriptor Block (CDB)”.
2735 The General Common CDB fields are defined in SPC‐4, 4.3.5 “Common CDB fields”.
2736 11.1.1.1 Operation code

2737 The first byte of a SCSI and USC CDB shall contain an operation code identifying the operation being
2738 requested by the CDB.
2739 The OPERATION CODE of the CDB contains a GROUP CODE field and COMMAND CODE field.
2740 The GROUP CODE field provides eight groups of command codes and the COMMAND CODE provides
2741 thirty-two command codes in each group, see [SPC] for further details..
2742 11.2 Universal Flash Storage Native Commands (UNC)

2743 The UFS Native commands are not defined in this version of the standard, they may be defined in future
2744 versions if needed.
Page 150
2745 11.3 Universal Flash Storage SCSI Commands

2746 The Basic Universal Flash Storage (UFS) SCSI Commands are compatible with SCSI Primary
2747 Commands - 4 [SPC] and SCSI Block Commands -3 [SBC].
2748 If enabled (bLUEnable = 01h), each logical unit shall support the commands defined as mandatory in
2749 Table 11.1.
2750 Table 11.1 — UFS SCSI Command Set
Command Support
Command name Opcode
Embedded Removable
FORMAT UNIT 04h M M
INQUIRY 12h M M
MODE SELECT (10) 55h M M
MODE SENSE (10) 5Ah M M
PRE-FETCH (10) 34h M M
PRE-FETCH (16) 90h O O
READ (6) 08h M M
READ (10) 28h M M
READ (16) 88h O O
READ BUFFER 3Ch O O
READ CAPACITY (10) 25h M M
READ CAPACITY (16) 9Eh M O
REPORT LUNS A0h M M
REQUEST SENSE 03h M M
SECURITY PROTOCOL IN A2h M O, R
SECURITY PROTOCOL OUT B5h M O, R
SEND DIAGNOSTIC 1Dh M M
START STOP UNIT 1Bh M M
SYNCHRONIZE CACHE (10) 35h M M
SYNCHRONIZE CACHE (16) 91h O O
TEST UNIT READY 00h M M
UNMAP 42H M M
VERIFY (10) 2Fh M M
WRITE (6) 0Ah M M
WRITE (10) 2Ah M M
WRITE (16) 8Ah O O
WRITE BUFFER 3Bh O O
M: mandatory, O: optional, R: RPMB
NOTE 1 SECURITY PROTOCOL IN command and SECURITY PROTOCOL OUT

command are supported by the RPMB well known logical unit.
2751
Page 151
2752 11.3.1 General information about SCSI commands in UFS

2753 The remaining part of this section describes the SCSI commands used in UFS devices. A dedicated
2754 paragraph for each command provides: CDB table, brief command description, relevant command fields,
2755 details about mandatory and optional features, and some other fundamental information.
2756 Fields that are not supported by UFS should be set to zero, and are documented using the notation
2757 “= 00h” (e.g., CONTROL=00h). The device may ignore values in fields that are not supported by UFS.
2758 NOTE The values enclosed in parenthesis are defined in SCSI standards and are not UFS specific
2759 (e.g., OPERATION CODE (12h)).
2760 In the follow some information that apply to several commands.
2761 CONTROL
2762 The CONTROL byte is present in several CDB and it is defined in [SAM]. The CONTROL byte is not
2763 used in this specification: the CONTROL byte should be set to zero and it shall be ignored by UFS
2764 device. No vendor specific interpretation and Normal ACA are assumed.
2765 Auto contingent allegiance (ACA)
2766 Establishing an ACA condition the application client may request that the device server alter command
2767 processing when a command terminates with a CHECK CONDITION status.
2768 UFS device does not support ACA.
2769 11.3.2 INQUIRY Command

2770 The INQUIRY command (see Table 11.2) is a request for information regarding the logical units and
2771 UFS target device be sent to the application client. Refer to [SPC] for more details regarding the
2772 INQUIRY command.
2773
2774 Table 11.2 — INQUIRY command
Bit
7 6 5 4 3 2 1 0
Byte
0 OPERATION CODE (12h)
1 Reserved Obsolete EVPD
2 PAGE CODE
3 (MSB)
ALLOCATION LENGTH*
4 (LSB)
5 CONTROL = 00h
* Allocation Length = Number of response bytes to return
2775 11.3.2.1 VITAL PRODUCT DATA

2776 When EVPD = 1, the device server shall return the vital product data specified by the PAGE CODE field
2777 as defined in [SPC]. Support for all vital product data except Mode Page Policy VPD is optional for UFS.
2778 Mode Page Policy VPD shall be supported by UFS device to provide information about Mode pages
2779 which are applicable to Device level or logical unit level. See [SPC] for data format definition of Mode
2780 Page Policy VPD page.
Page 152
2781 11.3.2.2 STANDARD INQUIRY DATA

2782 When EVPD =0 and Page Code = 0, the Standard INQUIRY DATA is responded to INQUIRY
2783 command. The standard INQUIRY data format is shown on Table 11.3), INQUIRY data shall contain at
2784 least 36 bytes. Table 11.4 defines the INQUIRY response data for UFS.
2785 The INQUIRY command requests that information regarding the logical unit and SCSI target device be
2786 sent to the Application Client.
2787 The INQUIRY command may be used by an Application Client after a hard reset or power on condition
2788 to determine information about the device for system configuration If a INQUIRY command is received
2789 with a pending UNIT ATTENTION condition (i.e., before the device server reports CHECK
2790 CONDITION status), the device server shall perform the INQUIRY command.
2791 INQUIRY information is returned in standard INQUIRY RESPONSE data structure (described below)
2792  Client requests number of bytes to return
2793  First 36 bytes are defined for UFS as standard
2794  Requesting zero byte is valid, 36 returns complete UFS defined record
2795  Requesting more bytes than defined will result in truncation to max number device has defined
2796 The Device Server should process the INQUIRY command even when an error occurs that prohibits
2797 normal command completion
2798  When in UNIT ATTENTION
2799  During other conditions that may affect medium access
2800 The Command CDB shall be sent in a single COMMAND UPIU
2801 Table 11.3 — Standard INQUIRY data format
Bit
7 6 5 4 3 2 1 0
Byte
0 PERIPHERAL QUALIFIER PERIPHERAL DEVICE TYPE = 00h
1 RMB Reserved
2 VERSION
3 Obsolete Obsolete NORMACA HISUP RESPONSE DATA FORMAT
4 ADDITIONAL LENGTH (n-4)
PROTEC
5 SCCS ACC TPGS 3PC Reserved
T
ENCSER Obsolet
6 Obsolete VS MULTIP Obsolete Obsolete ADDR16
V e
CMDQU
7 Obsolete Obsolete WBUS16 SYNC Obsolete Obsolete VS
E
8 (MSB)
VENDOR IDENTIFICATION
15 (LSB)
16 (MSB)
PRODUCT IDENTIFICATION
31 (LSB)
32 (MSB)
PRODUCT REVISION LEVEL
35 (LSB)
Page 153
2802 11.3.2.3 Inquiry Command Data Response

2803  Data returned from an INQUIRY command will be transferred to the Application Client in a
2804 single DATA IN UPIU
2805  The Device Server will transfer up to 36 Bytes of Response Data in the Data Segment area of a
2806 DATA IN UPIU
2807 o Return 36 bytes if Allocation Length in CDB >= 36
2808 o Return Allocation Length bytes if Allocation Length in CDB < 36
2809 o An Allocation Length of zero specifies that no data shall be transferred. This condition shall
2810 not be considered as an error, and DATA IN UPIU shall not be generated.
2811  Data will be returned in the indicated Response Data Format described below
2812  No DATA IN UPIU will be transferred if an error occurs
2813 11.3.2.4 Inquiry Response Data
2814 Table 11.4 — Inquiry Response Data
Byte Bit Value Description
0 7:5 000b PERIPHERAL QUALIFIER: 0
0 4:0 00000b PERIPHERAL TYPE: Direct Access Device
1 7 0b RMB: Medium not removable
1 6:0 0000000b RESERVED
2 7:0 06h VERSION: Conformance to [SPC]
3 7:4 0000b N/A
3 3:0 0010b RESPONSE DATA FORMAT: Type 2
4 7:0 31d ADDITIONAL LENGTH: 31 bytes
5 7:0 00h N/A
6 7:0 00h N/A
7 7:2 000000b N/A
7 1:1 1b CMDQUE: Support command management (SAM)
7 0:0 0b N/A
8:15 7:0 ASCII VENDOR IDENTIFICATION: Left justified (e.g., “Micron “)
PRODUCT IDENTIFICATION: Left justified (e.g., “UFS MSD
16:31 7:0 ASCII
M33-X ”)
32:35 7:0 ASCII PRODUCT REVISION LEVEL: Left justified (e.g., “1.23”)
NOTE 1 The fields marked with N/A are not applicable for UFS, and their values shall be zero.
2815 The 4-byte PRODUCT REVISION LEVEL in the Inquiry Response Data shall identify the firmware
2816 version of the UFS device and shall be uniquely encoded for any firmware modification implemented by
2817 the UFS device vendor.
2818
Page 154
2819 11.3.2.5 Inquiry Command Status Response

2820  STATUS response will be sent in a single RESPONSE UPIU
2821  If the requested data is successfully transferred, the INQUIRY command will terminate with a
2822 STATUS response of GOOD
2823  If the unit is not ready to accept a new command (e.g., still processing previous command) a
2824 STATUS response of BUSY will be returned
2825  Failure rarely occurs but for few reasons. When the INQUIRY command fails a STATUS
2826 response of CHECK CONDITION will be returned along with an appropriate SENSE KEY, such
2827 as
2828 o ILLEGAL REQUEST (range or CDB errors)
2829 o HARDWARE ERROR (hardware failure)
2830  Will not fail due to a pending UNIT ATTENTION condition
2831 11.3.3 MODE SELECT (10) Command

2832 MODE SELECT command provides a means for the application client to specify medium, logical unit, or
2833 peripheral device parameters to the device server.
2834  Parameters are managed by means of parameter pages called Mode Pages
2835 o UFS devices shall support the following mode pages
2836  CONTROL, CACHING, READ-WRITE ERROR RECOVERY
2837 o UFS devices may support vendor specific mode pages
2838 o See 11.4 for further details.
2839  Writes parameters to one or more parameter pages in a list
2840 o The Application Client can specify a single, multiple or all supported pages in a single
2841 command
2842  Complementary command to the MODE SENSE command
2844 Table 11.5 — MODE SELECT (10) Command
Bit
7 6 5 4 3 2 1 0
Byte
1 Reserved PF = 1b Reserved SP
2
3
4 Reserved
5
6
7
PARAMETER LIST LENGTH
8
9 CONTROL = 00h
Page 155
2845 11.3.3.1 Mode Select Command Parameters

2846 Table 11.6 — Mode Select Command Parameters
Byte Bit Description
PF: PAGE FORMAT. A page format bit set to zero specifies that all parameters after the
block descriptors are vendor specific. A PF bit set to one specifies that the MODE SELECT
1 4:4
parameters following the header and block descriptor(s) are structured as pages of related
parameters as defined in the SCSI standard.
SP: SAVE PAGES. A save pages (SP) bit set to zero specifies that the device server shall
perform the specified MODE SELECT operation, and shall not save any mode pages. If
the logical unit implements no distinction between current and saved mode pages and the
SP bit is set to zero, the command shall be terminated with CHECK CONDITION status,
with the sense key set to ILLEGAL REQUEST. An SP bit set to one specifies that the
device server shall perform the specified MODE SELECT operation, and shall save to a
nonvolatile vendor specific location all the saveable mode pages including any sent in the
1 0:0
Data-Out Buffer. Individual Mode pages that are saved are specified by the saveable
parameter bit (PS) that is returned in the first byte of each mode page when read via the
MODE SENSE command. If the PS bit is set to one in the MODE SENSE data, then the
mode page shall be saveable when issuing a MODE SELECT command with the SP bit
set to one. If the logical unit does not implement saved pages and the SP bit is set to one,
the command shall terminate with a CHECK CONDITION status and a sense key set to
ILLEGAL REQUEST.
PARAMETER LIST LENGTH: Specifies length in bytes of the mode parameter list that the
Application Client buffer will transfer to the Device Server. A PARAMETER LIST LENGTH
7:8 7:0
of zero specifies that no data shall be transferred, this shall not be considered an error and
in this case the device shall not send RTT UPIU.
2847 11.3.3.2 Mode Select Command Data Transfer

2848 The Device Server will request transfer PARAMETER LIST LENGTH number of bytes from a buffer in
2849 the Application Client by issuing one or more READY TO TRANSFER UPIU’s (RTT) followed by a
2850 DATA OUT UPIU per RTT and will subsequently write those to the appropriate Mode Page area within
2851 the Device Server
2852  The data transferred from the Application Client will be contained within the Data Segment of the
2853 DATA OUT UPIU
2854  After delivery the Device Server will sort through the parameter list to identify the individual
2855 mode pages
2856 Zero or an incomplete number of RTT’s and DATA OUT UPIU’s could be requested if a write error
2857 occurs before the entire data transfer is complete
2858 The Parameter List will be formatted as indicated by the Mode Parameter Layout
2859  Header (8 bytes)
2860  Block Descriptor (0 bytes for UFS)
2861  Page(s) Data (N bytes, dependent up number of pages sent)
Page 156
2862 11.3.3.3 Mode Select Command Status Response

2864  If the requested data is successfully transferred and written, the MODE SELECT command will
2865 terminate with a STATUS response of GOOD
2868  Failure can occur for numerous reasons. When the MODE SELECT command fails a STATUS
2870 as
2871 o ILLEGAL REQUEST (CDB or parameter errors)
2872 o MEDIUM ERROR (medium failure, ECC, etc.)
2874 o UNIT ATTENTION (reset, power-on, etc)
2875 11.3.4 MODE SENSE (10) Command

2876 The MODE SENSE command provides a means for a Device Server to report parameters to an
2877 Application Client
2878  Parameters are managed by means of parameter pages called Mode Pages
2879 o UFS devices shall support the following mode pages
2880  CONTROL, READ-WRITE ERROR RECOVERY, CACHING
2881 o UFS devices may support vendor specific mode pages
2882 o See 11.4 for further details
2883  Reads parameter pages in a list
2884 o The Application Client may request any one or all of the supported pages from the
2885 Device Server
2886 o If all pages requested, they will be returned in ascending page order
2887  Mode Sense returns DEVICE-SPECIFIC PARAMETER in header
2888 o See paragraph 11.4.1.3 “Mode Parameter Header” for details.
2889  Complementary command to the MODE SELECT command
2891
Page 157
2892 11.3.4 MODE SENSE (10) Command (cont’d)

2893 Table 11.7 — MODE SENSE (10) Command
Bit
7 6 5 4 3 2 1 0
Byte
0 OPERATION CODE (5Ah)
LLBAA DBD
1 Reserved =000b Reserved = 000b
=0b = 1b
2 PC PAGE CODE
3 SUBPAGE CODE
5 Reserved
7 (MSB)
ALLOCATION LENGTH
8 (LSB)
9 CONTROL = 00h
2894
2895 11.3.4.1 Mode Sense Command Parameters
2896
2897 Table 11.8 — Mode Sense Command Parameters
PC: The page control (PC) field specifies the type of mode parameter values to be
2 7:6
returned in the mode pages. See table below for definition.
PAGE CODE: Specifies which mode page to return. The Page and Subpage code specify
2 5:0
the page to return.
3 7:0 SUBPAGE CODE: Specifies which subpage mode page to return
ALLOCATION LENGTH: Specifies the maximum number of bytes the Device Server will
7:8 7:0
transfer to the Application Client
2898
2899
Page 158
2900 11.3.4.2 Page Control Function

2901 Table 11.9 — Page Control Function
Page
Control Description Use
(PC)
Current
00b Return the current operational mode page parameter values.
Values
Return a bit mask denoting values that are changeable. Changeable bits in
Changeable
01b the mode parameters will have a value of ‘1’, non-changeable will have a
Values
value of ‘0’.
10b Default Values Return the default values of the mode parameters.
11b Saved Values Return the saved values of the mode parameters.
2902 11.3.4.3 Mode Sense Command Data Transfer

2903 The Device Server will transfer up to Allocation Length number of data bytes of Mode Parameter Data to
2904 the Application Client.
2905  Less than Allocation Length will be transferred if Device Server contains less bytes
2906 The Device Server will transfer the data as indicated by the Mode Parameter Layout
2907  Header (8 bytes)
2908  Block Descriptor (0 bytes for UFS)
2909  Page Data (N bytes, dependent up page requested)
2910 Data will be transferred from the Device Server to the Application Client via a series of DATA IN
2911 UPIU’s
2912  The data transferred from the Device Server will be contained within the Data Segment of the
2913 DATA IN UPIU
2914 Zero or an incomplete number of DATA IN UPIU’s will be transferred if an error occurs before the entire
2915 data transfer is complete.
2916 11.3.4.4 Mode Sense Command Status Response

2918  If the requested data is successfully transferred and written, the MODE SENSE command will
2922  Failure occurs when a requesting a page or subpage that is not supported. A STATUS response of
2923 CHECK CONDITION will be returned with a SENSE KEY indicating ILLEGAL REQUEST
2924  Failure can occur for numerous reasons. When the MODE SENSE command fails a STATUS
2926 as
2927 o ILLEGAL REQUEST (CDB errors)
Page 159
2930 11.3.5 READ (6) Command

2931 The READ (6) command (see Table 11.10) requests that the Device Server read from the medium the
2932 specified number of logical block(s) and transfer them to the Application Client.
2933 The Command CDB shall be sent in a single COMMAND UPIU.
2934 Table 11.10 — READ (6) UFS Command
Bit
7 6 5 4 3 2 1 0
Byte
1 Reserved (MSB)
2
LOGICAL BLOCK ADDRESS
3 (LSB)
4 TRANSFER LENGTH
5 CONTROL = 00h
2935 11.3.5.1 Read (6) Command Parameters

2936  LOGICAL BLOCK ADDRESS: Address of first block
2937  TRANSFER LENGTH: Number of contiguous logical blocks of data that shall be read and
2938 transferred. A transfer length of zero specifies that 256 logical blocks shall be read. Any other
2939 value specifies the number of logical blocks that shall be read.
2940 11.3.5.2 Read (6) Command Data Transfer
2941  The Device Server will read the specified logical block(s) from the medium and transfer them to
2942 the Application Client in a series of DATA IN UPIU’s
2943  Zero or an incomplete number of DATA IN UPIU’s could be transferred if a read error occurs
2944 before the entire data transfer is complete
2945 11.3.5.3 Read (6) Command Status Response
2946  Status response will be sent in a single RESPONSE UPIU
2947  If all requested data is successfully read and transferred, the READ command will terminate with
2948 a STATUS response of GOOD
2951  Failure can occur for numerous reasons. When the READ command fails a STATUS response of
2952 CHECK CONDITION will be returned along with an appropriate SENSE KEY, such as
2957 o Etc.
Page 160
2958 11.3.6 READ (10) Command

2960 specified number of logical block(s) and transfer them to the Application Client
Bit
7 6 5 4 3 2 1 0
Byte
RDPROTECT
1 DPO FUA Reserved FUA_NV Obsolete
= 000b
2 (MSB)
3
4
5 (LSB)
6 Reserved GROUP NUMBER
7 (MSB)
TRANSFER LENGTH
8 (LSB)
9 CONTROL = 00h
2963
2964  The RDPROTECT field is set to ‘0’ for UFS.
2965
Page 161

2967  DPO = Disable Page Out
2968 “0” = specifies that the retention priority shall be determined by the RETENTION PRIORITY
2969 fields in the Caching mode page
2970 “1” = specifies that the device server shall assign the logical blocks accessed by this command
2971 the lowest retention priority for being fetched into or retained by the cache. A DPO bit set to one
2972 overrides any retention priority specified in the Caching mode page.
2973  FUA: Force Unit Access
2974 ‘0’ = The Device Server may read the logical blocks from the cache and/or the medium.
2975 ‘1’ = The Device Server shall read the logical blocks from the medium. If a cache contains a
2976 more recent version of a logical block, then the device server shall write the logical block to the
2977 medium before reading it.
2978  FUA_NV is defined per SBC. Since non-volatile cache support is not currently defined in this
2979 standard, the FUA_NV parameter value in the CDB is ignored by the UFS Device Server.
2982 transferred. A transfer length of zero specifies that no logical blocks will be read. This condition
2983 shall not be considered an error.
2984  GROUP NUMBER: Notifies the Target device that the data linked to a ContextID:
GROUP NUMBER Value Function
00000b Default, no function is associated with that read operation.
00001b to 01111b (0XXXXb) Context ID. (XXXX from 0001b to 1111b ‐ Context ID value)
10000b to 11111b Reserved
2985 In case the GROUP NUMBER is set to a value which is not supported the operation shall fail and
2986 a STATUS response of CHECK CONDITION will be returned along with an ILLEGAL
2987 REQUEST SENSE KEY.
3005 o Etc.
Page 162
3006 11.3.7 READ (16) Command

3008 specified number of logical block(s) and transfer them to the Application Client
Bit
7 6 5 4 3 2 1 0
Byte
RDPROTECT
1 DPO FUA Reserved FUA_NV Reserved
= 000b
2 (MSB)
…. LOGICAL BLOCK ADDRESS
9 (LSB)
10 (MSB)
…. TRANSFER LENGTH
13 (LSB)
14 Ignore Reserved GROUP NUMBER
15 CONTROL = 00h
3011  The RDPROTECT field is set to ‘0’ for UFS.

3012
Page 163

3014  DPO = Disable Page Out
3021 ‘0’ = The Device Server may read the logical blocks from the cache and/or the medium. ‘1’ = The
3022 Device Server shall read the logical blocks from the medium. If a cache contains a more recent
3023 version of a logical block, then the device server shall write the logical block to the medium
3024 before reading it.
3029 transferred. A transfer length of zero specifies that no logical blocks will be read. This condition
3030 shall not be considered an error.
3031  GROUP NUMBER: See Read (10) Command.


3049 o Etc.
Page 164
3050 11.3.8 READ CAPACITY (10) Command

3051 The READ CAPACITY (10) command provides a means for the UFS host to request the current capacity
3052 of the UFS device. Refer to [SBC] for more details regarding the READ CAPACITY (10) command.
3053  The READ CAPACITY (10) command requests that the device server transfer 8 bytes of
3054 parameter data describing the capacity and medium format of the direct-access block device
3055  Use to dynamically find number and size of addressable blocks (sectors) on the medium
3057 Table 11.13 — READ CAPACITY (10)
Bit
7 6 5 4 3 2 1 0
Byte
1 Reserved Obsolete
2 (MSB)
5 (LSB)
6 Reserved
7 Reserved
PMI
8 Reserved
= 0b
9 CONTROL = 00h
3058  PMI = 0 for UFS

3059  Logical Block Address = 0 for UFS
3060
Page 165
3061 11.3.8.1 Read Capacity (10) Data Response

3062  Data returned from a READ CAPACITY (10) command will be transferred to the Application
3063 Client in a single DATA IN UPIU
3064  The Device Server will transfer 8 Bytes of Capacity Data in the Data Segment area of a DATA
3065 IN UPIU
3066  Data will be returned in the indicated Read Capacity Parameter format described below
3068 11.3.8.2 Read Capacity (10) Parameter Data

3069 Table 11.14 — Read Capacity (10) Parameter Data
Bit
7 6 5 4 3 2 1 0
Byte
0 (MSB)
1
RETURNED LOGICAL BLOCK ADDRESS
2
3 (LSB)
4 (MSB)
5
LOGICAL BLOCK LENGTH
6
7 (LSB)
3070  Returned Logical Block Address = Last addressable block on medium under control of logical
3071 unit (LU)
3072 o If the number of logical blocks exceeds the maximum value that is able to be specified in the
3073 RETURNED LOGICAL BLOCK ADDRESS field, then the device server shall set the
3074 RETURNED LOGICAL BLOCK ADDRESS field to FFFF FFFFh. The application client
3075 should then issue a READ CAPACITY (16) command to request that the device server
3076 transfer the READ CAPACITY (16) parameter data to the data-in buffer.
3077  Logical Block Length = size of block in bytes
3078 o For UFS minimum size shall be 4096 bytes
3079
Page 166
3080 11.3.8.3 Read Capacity (10) Status Response

3082  If the requested data is successfully transferred, the READ CAPACITY command will terminate
3083 with a STATUS response of GOOD
3086  Failure can occur for a number of reasons. When the READ CAPACITY command fails a
3087 STATUS response of CHECK CONDITION will be returned along with an appropriate SENSE
3088 KEY, such as
3092 o Etc.
3093 11.3.9 READ CAPACITY (16) Command
3094 The READ CAPACITY (16) command provides a means for the UFS host to request the current capacity
3095 of the UFS device. Refer to [SBC] for more details regarding the READ CAPACITY (16) command.
3096  The READ CAPACITY (16) command requests that the device server transfer 32 bytes of
3097 parameter data describing the capacity and medium format of the direct-access block device
3098  Use to dynamically find number and size of addressable blocks (sectors) on the medium
3100 Table 11.15 — READ CAPACITY (16)
Bit
7 6 5 4 3 2 1 0
Byte
0 OPERATION CODE (9Eh)
1 Reserved SERVICE ACTION (10h)
2 (MSB)
9 (LSB)
10 (MSB)
…. ALLOCATION LENGTH
13 (LSB)
PMI
14 Reserved
= 0b
15 CONTROL = 00h
3101  PMI = 0 for UFS
3102  Logical Block Address = 0 for UFS
3103  Allocation Length = the maximum number of bytes that the application client has allocated for the returned
3104 parameter data.
3105
Page 167
3106 11.3.9.1 Read Capacity (16) Data Response

3107  Data returned from a READ CAPACITY (16) command will be transferred to the Application
3108 Client in a single DATA IN UPIU
3109  The Device Server will transfer 32 bytes of Capacity Data in the Data Segment area of a DATA
3110 IN UPIU
3111  Data will be returned in the indicated Read Capacity Parameter format described below
3113
Page 168
3114 11.3.9.2 Read Capacity (16) Parameter Data

3115 Table 11.16 — Read Capacity (16) Parameter Data
Bit
7 6 5 4 3 2 1 0
Byte
0 (MSB)
…. RETURNED LOGICAL BLOCK ADDRESS
7 (LSB)
8 (MSB)
…. LOGICAL BLOCK LENGTH
11 (LSB)
12 Reserved P_TYPE PROT_EN
LOGICAL BLOCKS PER PHYSICAL BLOCK

13 P_I_EXPONENT
EXPONENT
14 TPE TPRZ (MSB)

LOWEST ALIGNED LOGICAL BLOCK
ADDRESS
15 (LSB)
16
…. Reserved
31
3116  Returned Logical Block Address = Last addressable block on medium under control of logical
3117 unit (LU)
3118  Logical Block Length = size of block in bytes
3119 o For UFS minimum size shall be 4096 bytes
3120  P_TYPE, PROT_EN are set to ‘0’ for UFS
3121  The P_I_EXPONENT field can be ignored for PROT_EN = ‘0’
3122  Logical Blocks per Physical Block Exponent (vendor-specific information)
3123 o 0: one or more physical blocks per logical block
3124 o n>0: 2n logical blocks per physical block
3125  TPE is set to ‘0’ if bProvisioningType parameter in UFS Configuration Descriptor is set to 00h.
3126 TPE is set to ‘1’ if bProvisioningType is set to 02h or 03h.
3127  TPRZ value is set by bProvisioningType parameter in UFS Configuration Descriptor. If the thin
3128 provisioning read zeros (TPRZ) bit is set to one, then, for an unmapped LBA specified by a read
3129 operation, the device server shall send user data with all bits set to zero to the data in buffer. If the
3130 TPRZ bit is set to zero, then, for an unmapped LBA specified by a read operation, the device
3131 server shall send user data with all bits set to any value to the data in buffer. Lowest Aligned
3132 Logical Block Address indicates the LBA of the first logical block that is located at the beginning
3133 of a physical block (vendor-specific information)
Page 169
3134 11.3.9.3 Read Capacity (16) Status Response

3136  If the requested data is successfully transferred, the READ CAPACITY command will terminate
3140  Failure can occur for a number of reasons. When the READ CAPACITY command fails a
3142 KEY, such as
3146 o Etc.
3147
Page 170
3148 11.3.10 START STOP UNIT

3149 The START STOP UNIT command requests that the device server change the power condition of the
3150 logical unit or load or eject the medium.
3151  Enable or disable the direct-access block device for medium access operations by controlling
3152 power
3154 Table 11.17 — START STOP UNIT command
Bit
7 6 5 4 3 2 1 0
Byte
1 Reserved IMMED
2 Reserved
3 Reserved POWER CONDITION MODIFIER = 0h
LOEJ
4 POWER CONDITIONS Reserved NO_FLUSH START
= 0b
5 CONTROL = 00h
3155 IMMED = 0 : Return STATUS (RESPONSE UPIU) after operation is completed

3156 IMMED = 1 : Return STATUS after CDB is decoded
3157 11.3.10.1 START STOP UNIT Parameters
3158 Power Condition Modifier shall be set to ‘0’ (reserved) in UFS spec.
3159 Use of the other parameters is defined in the Power Mode section.
3160 11.3.10.2 Start Stop Unit Data Response
3161  The START STOP UNIT command does not have a data phase
3162  No DATA IN or DATA OUT UPIU’s are transferred
3163 11.3.10.3 Start Stop Unit Status Response
3165  If IMMED = 1 in the CDB, the STATUS response will be sent to the Application Client before
3166 the device operations have been completed
3167 o Usually used for shutting down
3168  If the requested operation is successful, the START STOP UNIT command will terminate with a
3172  Failure can occur for few reasons. When the START STOP UNIT command fails a STATUS
3174 as
3177 o UNIT ATTENTION
Page 171
3178 11.3.11 TEST UNIT READY Command

3179 The TEST UNIT READY command provides a means to check if the logical unit is ready. This is not a
3180 request for a self-test.
3181  If the logical unit is able to accept an appropriate medium-access command without returning
3182 CHECK CONDITION status, this command shall return a GOOD status.
3183  If the logical unit is unable to become operational or is in a state such that an Application Client
3184 action (e.g., START UNIT command) is required to make the logical unit ready, the command
3185 shall be terminated with CHECK CONDITION status, with the sense key set to NOT READY
3186 (02h).
3188 Table 11.18 — TEST UNIT READY command
Bit
7 6 5 4 3 2 1 0
Byte
1 Reserved
2 Reserved
3 Reserved
4 Reserved
5 CONTROL = 00h
3189 11.3.11.1 Test Unit Ready Data Response

3190  The TEST UNIT READY command does not have a data response
3192 11.3.11.2 Test Unit Ready Status Response
3193  STATUS response will be sent in a single RESPONSE UPIU.
3194  If the command succeeds without error, the TEST UNIT READY command will terminate with a
3198  Failure can occur for numerous reasons. When the TEST UNIT READY command fails a
3200 KEY, such as
3204 o Etc.
Page 172
3205 11.3.12 REPORT LUNS Command

3206 The REPORT LUNS command requests that the peripheral device logical unit inventory be sent to the
3207 Application Client.
3208  The logical unit inventory is a list that shall include the logical unit numbers of all logical units
3209 accessible to a UFS Application Client
3210  If a REPORT LUNS command is received with a pending unit attention condition (i.e., before the
3211 device server reports CHECK CONDITION status), the device server shall perform the REPORT
3212 LUNS command
3214 Table 11.19 — REPORT LUNS command
Bit
7 6 5 4 3 2 1 0
Byte
0 OPERATION CODE (A0h)
1 Reserved
2 SELECT REPORT
3 (MSB)
Reserved
5 (LSB)
6 (MSB)
ALLOCATION LENGTH
9 (LSB)
10 Reserved
11 CONTROL = 00h
3215
3216
Page 173
3217 11.3.12.1 Report LUNS Command Parameters

3218 Table 11.20 — Report LUNS Command Parameters
SELECT REPORT: Specifies the type of logical unit addresses that shall be
2 7:0 reported. The report types available are listed in the table below. UFS will support
all report types.
ALLOCATION LENGTH: Specifies the maximum number of bytes of buffer space

6:9 7:0
that the Application Client has allocated for data reception.
3219
3220 11.3.12.2 Report LUNS Command Select Report Field Values
3221 Table 11.21 — Report LUNS Command Select Report Field Values
REPORT
DESCRIPTION
CODE
The list shall contain all accessible logical units using the single level LUN
00h structure using the peripheral device addressing method, if any. If there are
no logical units, the LUN LIST LENGTH field shall be zero.
The list shall contain all accessible well known logical units, if any using the
01h well known logical unit extended addressing format. If there are no well
known logical units, the LUN LIST LENGTH field shall be zero.
The list shall contain all accessible logical units using their respective
02h
addressing format.
03h-FFh Reserved
3222 11.3.12.3 Report LUNS Data Response

3223  Data returned from a REPORT LUNS command will be transferred to the Application Client in a
3224 one or more DATA IN UPIU’s
3225  Most likely one DATA IN UPIU
3226  The Device Server will transfer less than or equal to Allocation Length data bytes to the
3227 Application Client.
3228  Less if Device Server has less total data than requested
3229  Data will be returned in the indicated Parameter Data Format described below
3230  Each reportable logical unit will produce 8 bytes of data in a format described below
3231
Page 174
3232 11.3.12.4 Report LUNS Parameter Data Format

3233 Table 11.22 — Report LUNS Parameter Data Format
Byte Description
LUN LIST LENGTH: Length = N – 7. This field shall contain the length in bytes of the
0:3 LUN list that is available to be transferred. The LUN list length is the number of
logical unit numbers in the logical unit inventory multiplied by eight.
4:7 RESERVED: 00000000h
8:15 FIRST LUN RECORD: 8 byte record that contains the first LUN
… … next LUN record …
N-7:N LAST LUN RECORD: 8 byte record that contains the last LUN
3234  Total List Length = LUN LIST LENGTH + 8, (8*number of LUN’s + 8)

3235  Each LUN record is 8 bytes in length
3236  UFS uses two formats:
3237 o The single level LUN structure using peripheral device addressing method
3238 o The well known logical unit extended addressing format
3239
3240 11.3.12.5 Report LUNS LUN Addressing Formats
3241 Table 11.23 — Single level LUN structure using peripheral device addressing method
Peripheral Device Addressing Method
Byte 7 6 5 4 3 2 1 0
0 00b 000000b
1 LUN
2
NULL (0000h)
3
4
NULL (0000h)
5
6
NULL (0000h)
7
3242  Format used for standard Logical Unit addressing

3243  LUN = Logical Unit Number
3244 o For UFS: 00h <= LUN <= 7Fh
3245 NOTE The expected value is the SCSI LUN and not the LUN field in UPIU.
Page 175
3246 11.3.12.5 Report LUNS LUN Addressing Formats (cont’d)

3247 Table 11.24 — Well Known Logical Unit Extended Addressing Format
Well Known Logical Unit Extended Addressing Format
Byte 7 6 5 4 3 2 1 0
0 11b 00b 0001b
1 W-LUN
2
NULL (0000h)
3
4
NULL (0000h)
5
6
NULL (0000h)
7
3248  Format used for well known logical unit addressing

3249  W-LUN = Well Known Logical Unit Number
3250 o For UFS: 00h <= W-LUN <= 7Fh
3251 NOTE The expected value is the SCSI LUN and not the LUN field in UPIU.
3252
3253 11.3.12.6 Report LUNS Status Response
3255  If all requested data is successfully read and transferred, the REPORT LUNS command will
3257  The REPORT LUNS command will succeed when a pending UNIT ATTENTION condition
3258 exists
3259  Failure can occur for very few reasons, mainly for illegal values in the CDB. When the REPORT
3260 LUNS command fails a STATUS response of CHECK CONDITION will be returned along with
3261 an appropriate SENSE KEY, such as
3263
Page 176
3264 11.3.12.7 UFS LUN Format

3265 Table 11.25 — Format of LUN field in UPIU
7 6 5 4 3 2 1 0
WLUN_ID UNIT_NUMBER_ID
3266
3267 The UFS 8-bit LUN field in UPIU supports two types of LUN addressing:
3268  If WLUN_ID bit = ‘0’ then the UNIT_NUMBER_ID field addresses a standard logical unit
3269 (LUN)
3270  If WLUN_ID bit = ‘1’ then the UNIT_NUMBER_ID field addresses a well known logical unit
3271 (W-LUN)
3272 Up to 128 LUN’s and up to 128 W-LUN’s
3273  0 <= UNIT_NUMBER_ID <= 127
3274  0 <= UNIT_NUMBER_ID <= 127
3275 The following table defines the logical unit number for UFS well known logical units (WLUN_ID bit set
3276 to ‘1’)
3277 Table 11.26 — Well known logical unit numbers
Well known logical unit WLUN_ID UNIT_NUMBER_ID LUN Field in UPIU
REPORT LUNS 1b 01h 81h
UFS Device 1b 50h D0h
RPMB 1b 44h C4h
BOOT 1b 30h B0h

3278
Page 177
3279 11.3.13 VERIFY (10)

3280 The VERIFY command requests that the UFS device verify that the specified logical block(s) and range
3281 on the medium can be accessed.
3282  Logical units that contain cache shall write referenced cached logical blocks to the medium for
3283 the logical unit before verification
3285
3286 Table 11.27 — VERIFY Command Descriptor Block
Bit
7 6 5 4 3 2 1 0
Byte
0 OPERATION CODE (2Fh)
BYTCH Obsolet
VRPROTECT DPO
1 Reserved K e
= 000b =0
=0 =0
2 (MSB)
3
4
5 (LSB)
GROUP NUMBER
6 Reserved
= 0h
7 (MSB)
VERIFICATION LENGTH
8 (LSB)
9 CONTROL = 00h
3287
3288 UFS device is required to support only the value zero for the byte check (BYTCHK) bit. Therefore the
3289 BYTCHK bit should be set to zero, and the device shall perform a medium verification with no data
3290 comparison and not transfer any data from the data-out buffer for any mapped LBA specified by the
3291 command.
3292
Page 178
3293 11.3.13.1 Verify Command Parameters

3294 Table 11.28 — Verify Command Parameters
2:5 7:0 LOGICAL BLOCK ADDRESS: Address of first block
VERIFICATION LENGTH: Number of contiguous logical blocks of data that

shall be verified, starting with the logical block specified by the LOGICAL
7:8 7:0
BLOCK ADDRESS field. A transfer length of zero specifies that no logical
blocks will be verified. This condition shall not be considered an error.
3295 11.3.13.2 Verify Command Data Transfer

3296 The VERIFY command does not have a data response
3298 11.3.13.3 Verify Command Status Response
3300  If all requested data is successfully verified against the medium, the VERIFY command will
3304  Other failures can occur for numerous reasons. When the WRITE command fails a STATUS
3306 as
3307  ILLEGAL REQUEST (range or CDB errors)
3308  MEDIUM ERROR (medium failure, ECC, etc.)
3309  HARDWARE ERROR (hardware failure)
3310  UNIT ATTENTION (reset, power-on, etc)
3311  Etc.
Page 179
3312 11.3.14 WRITE (6) Command

3313 The WRITE (6) UFS command requests that the Device Server transfer the specified number of logical
3314 blocks(s) from the Application Client and write them to the medium
3316 Table 11.29 — WRITE (6) Command Descriptor Block
Bit
7 6 5 4 3 2 1 0
Byte
1 Reserved (MSB)
2
3 (LSB)
4 TRANSFER LENGTH
5 CONTROL = 00h
3317
3318 11.3.14.1 Write (6) Command Parameters
3320  TRANSFER LENGTH: Number of contiguous logical blocks of data that shall be transferred and
3321 written. A transfer length of zero specifies that 256 logical blocks shall be written. Any other
3322 value specifies the number of logical blocks that shall be written.
3323
3324 11.3.14.2 Write (6) Command Data Transfer
3325 The Device Server will transfer the specified logical block(s) from the Application Client by issuing a
3326 series of READY TO TRANSFER UPIU’s (RTT) followed by a DATA OUT UPIU per RTT and will
3327 subsequently write them.
3330
Page 180
3331 11.3.14.3 Write (6) Command Status Response

3333  If all requested data is successfully transferred and written, the WRITE command will terminate
3335  If the logical blocks are transferred directly to a cache then the Device Server may complete the
3336 command with a GOOD status prior to writing the logical blocks to the medium
3339  Failure can occur for numerous reasons. When the WRITE command fails a STATUS response
3340 of CHECK CONDITION will be returned along with an appropriate SENSE KEY, such as
3345 o Etc.
3346
3347
Page 181
3348 11.3.15 WRITE (10) Command

3350 blocks(s) from the Application Client and write them to the medium.
Bit
7 6 5 4 3 2 1 0
Byte
WRPROTECT Reserve FUA_N Obsolet

1 DPO FUA
= 000b d V e
(MSB
2
)
3
4
5 (LSB)
(MSB
7
)
TRANSFER LENGTH
8 (LSB)
9 CONTROL = 00h
3353
3354  The WRPROTECT field is set to ‘0’ for UFS.
3355
3356
Page 182

3358  DPO: Disable Page Out
3365 o ‘0’ = The Device Server shall write the logical blocks to the cache and/or the medium.
3366 o ‘1’ = The Device Server shall write the logical blocks to the medium, and shall not
3367 complete the command with GOOD status until all the logical blocks have been written
3368 on the medium without error.
3372  TRANSFER LENGTH: Number of contiguous logical blocks of data that shall be transferred
3373 and written. A transfer length of zero specifies that no logical blocks will be written. This
3374 condition shall not be considered an error.
3375  GROUP NUMBER: Notifies the Target device that the data has System Data characteristics or
3376 linked to a ContextID:
3377
GROUP NUMBER Value Function
00000b Default, no function is associated with that read operation.
00001b to 01111b Context ID. (XXXX from 0001b to 1111b ‐ Context ID

(0XXXXb) value)
10000b Data has System Data characteristics
10001b to 11111b Reserved
3378
3379 In case the GROUP NUMBER is set to a value which is not supported the operation shall fail and
3380 a STATUS response of CHECK CONDITION will be returned along with an ILLEGAL
3381 REQUEST SENSE KEY.
3382 11.3.15.2 Write(10) Command Data Transfer
3387 occurs before the entire data transfer is complete.
Page 183

3391 with a STATUS response of GOOD.
3393 command with a GOOD status prior to writing the logical blocks to the medium.
3395 STATUS response of BUSY will be returned.
3402 o Etc.
3403
Page 184
3404 11.3.16 WRITE (16) Command

3406 blocks(s) from the Application Client and write them to the medium.
Bit
7 6 5 4 3 2 1 0
Byte
WRPROTECT Reserve FUA_N Reserve

1 DPO FUA
= 000b d V d
2 (MSB)
9 (LSB)
10 (MSB)
…. TRANSFER LENGTH
13 (LSB)
14 Ignore Reserved GROUP NUMBER
15 CONTROL = 00h
3409
3410  The WDPROTECT field is set to zero for UFS.
3411
Page 185

3413  DPO: Disable Page Out
3420 ‘0’ = The Device Server shall write the logical blocks to the cache and/or the medium.
3421 ‘1’ = The Device Server shall write the logical blocks to the medium, and shall not complete
3422 the command with GOOD status until all the logical blocks have been written on the
3423 medium without error.
3427  TRANSFER LENGTH: Number of contiguous logical blocks of data that shall be transferred
3428 and written. A transfer length of zero specifies that no logical blocks will be written. This
3429 condition shall not be considered an error.
3430  GROUP NUMBER: See Write (10) Command.
3431
3432 11.3.16.2 Write (16) Command Data Transfer
3437 occurs before the entire data transfer is complete.
3438
Page 186

3444 command with a GOOD status prior to writing the logical blocks to the medium.
3453 o Etc.
Page 187
3454 11.3.17 REQUEST SENSE Command

3455 The REQUEST SENSE Command requests that the Device Server transfer parameter data containing
3456 sense data information to the Application Client.
3457  Sense Data describes error or exception condition and/or current operational status of device
3458 o i.e., get the device “status”
3459  UFS devices will return a fixed format data record of 18 bytes of sense data as described below.
3460  Three tiered error code for detailed status
3461 o Sense Key: main indicator
3462 o ASC: Additional Sense Code
3463 o ASCQ: Additional Sense Code Qualifier
3464  If a REQUEST SENSE command is received with a pending UNIT ATTENTION condition (i.e.,
3465 before the device server reports CHECK CONDITION status), the device server shall perform the
3466 REQUEST SENSE command and clear the UNIT ATTENTION condition.
3468 Table 11.32 — REQUEST SENSE Command Descriptor Block
Bit
7 6 5 4 3 2 1 0
Byte
DESC
1 Reserved
= 0b
2 (MSB)
Reserved
3 (LSB)
4 ALLOCATION LENGTH
5 CONTROL = 00h
3469 UFS devices are not required to support descriptor format sense data.
3470 11.3.17.1 Request Sense Data Response
3471  Data returned from a REQUEST SENSE command will be transferred to the Application Client
3472 in a single DATA IN UPIU.
3473  The Device Server will transfer up to 18 Bytes of Response Data in the Data Segment area of a
3474 DATA IN UPIU.
3475 o Return 18 bytes if Allocation Length in CDB >= 18.
3476 o Return Allocation Length bytes if Allocation Length in CDB < 18.
3477 o An Allocation Length of zero specifies that no data shall be transferred. This condition
3478 shall not be considered as an error, and DATA IN UPIU shall not be generated.
3479  Data will be returned in the indicated Sense Data Format described below.
Page 188
3480 11.3.17.2 Sense Data

3481 Table 11.33 — Sense Data
Byte Bit Name Description
A VALID bit set to one indicates INFORMATION
7 VALID
field contains valid data
0
= 1110000b
6:0 RESPONSE CODE
70h: fixed format sense data, current errors
1 7:0 Obsolete = 00h
7:5 FILEMARK, EOM, ILI = 000b (Reserved for UFS mass storage device)
2 4 Reserved = 0b
3:0 SENSE KEY Error or exception indicator (see table below)
3:6 7:0 INFORMATION Error dependent information
ADDITIONAL SENSE = Ah
7 7:0
LENGTH It indicates that 10 additional sense bytes will follow.
= 0000 0000h
It may contain information that depends on the
COMMAND-SPECIFIC
8:11 7:0 command on which the exception condition
INFORMATION
occurred. This field is reserved for UFS and it
should be set to zero..
ASC field indicates further information related to the
ADDITIONAL SENSE error or exception condition reported in the SENSE
12 7:0
CODE KEY field. Support of the additional sense codes not
described in this document is optional.
ASCQ field indicates detailed information related to
ADDITIONAL SENSE the additional sense code. Support of the additional
13 7:0
CODE QUALIFIER sense code qualifiers not described in this
document is optional.
FIELD REPLACEABLE
14 7:0 = 00h
UNIT CODE
= 0b
An SKSV bit set to zero indicates that the SENSE
7:7 SKSV
KEY SPECIFIC field is not as defined by this
15 standard.
000000b
SENSE KEY
6:0 This field is reserved for UFS and it should be set to
SPECIFIC
zero
0000h
SENSE KEY
16:17 7:0 This field is reserved for UFS and it should be set to
SPECIFIC
zero
3482
Page 189
3483 11.3.17.3 Sense Key Descriptions

3484 Table 11.34 — Sense Key Descriptions
Sense Key Name Descriptions
0h NO SENSE No additional information or no error.
Command completed successfully with some recovery

1h RECOVERED ERROR
action
2h NOT READY Logical unit is not accessible
3h MEDIUM ERROR Command failed due to flaw in medium or recording error
4h HARDWARE ERROR Failure due to hardware (controller, device, parity, etc.)
Failure due to illegal address or parameter or unsupported

5h ILLEGAL REQUEST
command
Unit attention condition established (unit reset, power-on,

6h UNIT ATTENTION
removal, etc)
7h DATA PROTECT Failure due to access of protected area of medium
8h BLANK CHECK Not applicable for block device (UFSMSD)
9h VENDOR SPECIFIC Not applicable for UFS device
Ah COPY ABORTED Not applicable for UFS device
Bh ABORTED COMMAND Device aborted execution of the command
Ch Obsolete -
Dh VOLUME OVERFLOW Failure to write all data because end of range or partition
Eh MISCOMPARE Indicates source data did not match data read from medium
Fh RESERVED Reserved
3485
3486
Page 190
3487 11.3.17.4 ASC and ASCQ

3488 The Sense Key is used for normal error handling during operation.
3489 The Additional Sense Code (ASC) and the Additional Sense Code Qualifier (ASCQ) are mainly used for
3490 detailed diagnostic and logging (post-mortem) information. If the device server does not have further
3491 information related to the error or exception condition, these fields shall be set to zero. Generally, except
3492 for a certain few, they’re not mandatory and they may be set to zero,, which means no additional
3493 information provided. See [SPC] for a list of additional sense codes and additional sense code qualifiers.
3494
3495 11.3.17.5 Request Sense Status Response
3497  If the requested data is successfully transferred, the REQUEST SENSE command will terminate
3501  Failure is very rare. When the REQUEST SENSE command fails a STATUS response of
3503 o ILLEGAL REQUEST (range or CDB errors).
3504  Will not fail due to a pending UNIT ATTENTION condition.
3505  If the REQUEST SENSE command was received with a pending unit attention condition, the
3506 returned sense data will indicate the cause of the unit attention condition, and the unit attention
3507 condition within the device server will be cleared.
3508  If a REQUEST SENSE command is terminated with CHECK CONDITION status, then the
3509 device server shall not clear the pending unit attention condition.
3510
3511
Page 191
3512 11.3.18 FORMAT UNIT Command

3513 The FORMAT UNIT command requests that the Device Server format the medium into Application
3514 Client accessible logical blocks as specified in the parameter lists. The Device Server may also certify the
3515 medium and create control structures for the management of the medium and defects. The degree that the
3516 medium is altered by the command is vendor specific.
3518 Table 11.35 — FORMAT UNIT Command Descriptor Block
Bit
7 6 5 4 3 2 1 0
Byte
LONGLI FMTDAT
1 FMTPINFO CMPLST DEFECT LIST FORMAT
ST A
2 Vendor Specific
3 (MSB)
Reserved
4 (LSB)
5 CONTROL = 00h
3519 11.3.18.1 Format Unit Command Parameters

3520 Table 11.36 — Format Unit Command Parameters
FMTPINFO: Specifies the FORMAT PROTECTION INFORMATION as detailed in

1 7:6
[SBC].
LONGLIST: If set to ‘0’ then the parameter list, if any, will use the SHORT parameter
1 5 list header as defined in [SBC]. If set to ‘1’ then the parameter list uses the LONG
format.
FMTDATA: If set to ‘1’ specifies that parameter list data shall be transferred during the
1 4
DATA OUT phase.
CMPLST: Complete List. ‘0’ indicates that the parameter list contains a partial growing
1 3
list of defects. A ‘1’ indicates the list is complete. See [SBC].
DEFECT LIST FORMAT: If the FMTDATA bit is set to one, then the DEFECT LIST
1 2:0 FORMAT field specifies the format of the address descriptors in the defect list. See
[SBC].
2 7:0 VENDOR SPECIFIC: Vendor specified field.

Page 192
3521 11.3.18.2 Format Unit Command Data Transfer

3522 The FORMAT UNIT command will transfer out the number of bytes specified within the Parameter List
3523 header format.
3524 The Device Server will request the transfer of the specified bytes from the Application Client by issuing a
3525 series of READY TO TRANSFER UPIU (RTT) followed by a DATA OUT UPIU containing the number
3526 of bytes to transfer.
3527 11.3.18.3 Format Unit Command Status Response
3529  If the requested format of the medium is performed successfully then the command will terminate
3533  Other failures can occur for numerous reasons. When the FORMAT UNIT command fails, a
3535 KEY, such as
3540 o Etc.
3541
Page 193
3542 11.3.19 PRE-FETCH (10) Command

3543 The PRE-FETCH (10) command shall require the device server to transfer the logical blocks for the
3544 mapped LBAs specified by the command from the medium to the volatile cache (if such cache exists) and
3545 for any unmapped LBAs specified by the command to update the volatile cache to prevent retrieval of
3546 stale data as defined in [SBC].
3548 Table 11.37 — PRE_FETCH Command Descriptor Block
Bit
7 6 5 4 3 2 1 0
Byte
1 Reserved IMMED Obsolete
2 (MSB)
3
4
5 (LSB)
6 Reserved GROUP NUMBER = 00000b
7 (MSB)
PRE-FETCH LENGTH
8 (LSB)
9 CONTROL= 00h
3549
3550
Page 194
3551 11.3.19.1 PRE-FETCH (10) Command Parameters

3552 Table 11.38 — PRE-FETCH Command Parameters
IMMED: An immediate (IMMED) bit set to zero specifies that the device server shall
not return status until the operation has been completed. An IMMED bit set to one
specifies that the device server shall return status as soon as the CDB has been
1 1 validated. If the IMMED bit is set to one, and the device server does not support the
IMMED bit, then the device server shall terminate the command with CHECK
CONDITION status with the sense key set to ILLEGAL REQUEST and the additional
sense code set to INVALID FIELD IN CDB.
LOGICAL BLOCK ADDRESS: The LOGICAL BLOCK ADDRESS field specifies the
LBA of the first logical block accessed by this command. If the specified LBA
exceeds the capacity of the medium, then the device server shall terminate the
2:5 7:0
command with CHECK CONDITION status with the sense key set to ILLEGAL
REQUEST and the additional sense code set to LOGICAL BLOCK ADDRESS OUT
OF RANGE.
GROUP NUMBER: The GROUP NUMBER field specifies the group into which
attributes associated with the command should be collected. A GROUP NUMBER
6 4:0 field set to zero specifies that any attributes associated with the command shall not
be collected into any group. The use of GROUP NUMBER field for PRE-FETCH
command is not defined in this specification therefore this field should be set to zero.
PRE-FETCH LENGTH: The PRE-FETCH LENGTH field specifies the number of

contiguous logical blocks that shall be pre-fetched, starting with the logical block
specified by the LOGICAL BLOCK ADDRESS field. A NUMBER OF LOGICAL
BLOCKS field set to zero specifies that all logical blocks starting with the one
specified in the LOGICAL BLOCK ADDRESS field to the last logical block on the
7:8 7:0 medium shall be pre-fetched. If the LBA plus the pre-fetch length exceeds the
capacity of the medium, then the device server shall terminate the command with
CHECK CONDITION status with the sense key set to ILLEGAL REQUEST and the
additional sense code set to LOGICAL BLOCK ADDRESS OUT OF RANGE.
The device server is not required to transfer logical blocks that already are contained
in the cache.
CONTROL: The CONTROL byte is not used in this specification:

9 7:0
the CONTROL byte should be set to zero and it shall be ignored by UFS device.
3553
3554
Page 195
3555 11.3.19.2 PRE-FETCH Command Data Transfer

3556 The PRE-FETCH command does not have a data transfer phase
3558 11.3.19.3 PRE-FETCH Command Status Response
3560  If the command is performed successfully then it will terminate with a STATUS response of
3561 GOOD
3564  Other failures can occur for numerous reasons. When the PRE-FETCH command fails, a
3566 KEY, such as
3571 o Etc.
3572
Page 196
3573 11.3.20 PRE-FETCH (16) Command

3574 See PRE-FETCH (10) command for details.
3575
3576 Table 11.39 — PRE-FETCH (16) Command Descriptor Block
Bit
7 6 5 4 3 2 1 0
Byte
1 Reserved IMMED Obsolete
2 (MSB)
9 (LSB)
10 (MSB)
…. NUMBER OF LOGICAL BLOCKS
13 (LSB)
15 CONTROL= 00h
3577
3578
Page 197
3579 11.3.21 SECURITY PROTOCOL IN Command

3580 The SECURITY PROTOCOL IN command is used to retrieve security protocol information or the results
3581 of one or more SECURITY PROTOCOL OUT commands. See [SPC] for details.
3582
3583 Table 11.40 — SECURITY PROTOCOL IN command
Bit
7 6 5 4 3 2 1 0
Byte
0 OPERATION CODE (A2h)
1 SECURITY PROTOCOL
2
SECURITY PROTOCOL SPECIFIC
3
4 INC_512 Reserved
5 Reserved
6 (MSB)
ALLOCATION LENGTH
9 (LSB)
10 Reserved
11 CONTROL = 00h
3584 11.3.21.1 SECURITY PROTOCOL IN Command Parameter

3585  The SECURITY PROTOCOL field specifies which security protocol is being used.
3586 UFS devices shall support the following value:
3587 o ECh: JEDEC UFS application
3588 Support of other SECURITY PROTOCOL values is device specific.
3589  The INC_512 bit specifies if the ALLOCATION LENGTH is expressed in increments of 512
3590 bytes or in bytes.
3591 11.3.21.2 SECURITY PROTOCOL IN Command Data Transfer
3592  The Device Server transfers security protocol data to the Application Client using one or more
3593 DATA IN UPIU’s.
Page 198
3594 11.3.21.3 SECURITY PROTOCOL IN Command Status Response

3595  Status response shall be sent in a single RESPONSE UPIU
3596  If the command is successfully executed, it shall terminate with a STATUS response of GOOD
3597  Failure can occur for numerous reasons. When the command fails a STATUS response of
3602  Etc.
3603
Page 199
3604 11.3.22 SECURITY PROTOCOL OUT Command

3605 The SECURITY PROTOCOL OUT command is used to send data to the logical unit. The data sent
3606 specifies one or more operations to be performed by the logical unit. The format and function of the
3607 operations depends on the contents of the SECURITY PROTOCOL field. See [SPC] for details.
3608 Table 11.41 — SECURITY PROTOCOL OUT command
Bit
7 6 5 4 3 2 1 0
Byte
0 OPERATION CODE (B5h)
1 SECURITY PROTOCOL
2
3
4 INC_512 Reserved
5 Reserved
6 (MSB)
TRANSFER LENGTH
9 (LSB)
10 Reserved
11 CONTROL = 00h
3609 11.3.22.1 SECURITY PROTOCOL OUT Command Parameter

3610  The SECURITY PROTOCOL field specifies which security protocol is being used.
3611 UFS devices shall support the following value:
3612 o ECh: JEDEC UFS application
3613 Support of other SECURITY PROTOCOL values is device specific.
3614  The INC_512 bit specifies if the ALLOCATION LENGTH is expressed in increments of 512
3615 bytes or in bytes.
3616 11.3.22.2 SECURITY PROTOCOL OUT Command Data Transfer
3617  The Device Server shall request the transfer of security protocol data issuing one or more
3618 READY TO TRANSFER UPIU’s (RTT).
3619  The Application Client should respond to each RTT with a DATA OUT UPIU providing the
3620 requested data.
3621  Zero or an incomplete number of RTT’s may be requested if an error occurs before the entire data
3622 transfer is complete.
3623
Page 200
3624 11.3.22.3 SECURITY PROTOCOL OUT Command Status Response

3625  Status response shall be sent in a single RESPONSE UPIU
3626  If the command is successfully executed, it shall terminate with a STATUS response of GOOD
3627  Failure can occur for numerous reasons. When the command fails a STATUS response of
3632  Etc.
Page 201
3633 11.3.23 SEND DIAGNOSTIC Command

3634 The SEND DIAGNOSTIC command requests that the Device Server perform diagnostic operations on
3635 the SCSI target device, on the logical unit or on both. Logical units shall implement, at a minimum, the
3636 default self-test feature when the SELFTEST bit is set to ‘1’.
3638 Table 11.42 — SEND DIAGNOSTIC Command Descriptor Block
Bit
7 6 5 4 3 2 1 0
Byte
0 OPERATION CODE (1Dh)
SELFTES DEVOFF UNITOFF

1 SELF-TEST CODE PF 0
T L L
2 Reserved
3 (MSB)
Parameter List Length
4 (LSB)
5 CONTROL = 00h
3639 11.3.23.1 Send Diagnostic Parameters

3640 Table 11.43 — Send Diagnostic Parameters
1 7:5 SELF-TEST CODE: Specifies the self-test code as defined in SPC4.
1 4 PF: Specifies the format of any parameter list sent by the Application Client
1 2 SELFTEST: Specifies the device server shall perform a self test.
DEVOFFL: If set to ‘0’, the device server will perform a self-test without exhibiting
1 1 any effects on the logical unit. If set to ‘1’, the device server may perform a self-test
that affects the logical unit.
UNITOFFL: If set to ‘0’, the device server will perform a self-test without exhibiting
1 0 any effects on the user accessible medium of the logical unit. If set to ‘1’, the device
server may perform operations that affect the user accessible medium.
PARAMETER LIST LENGTH: Specifies the length in bytes that shall be transferred
1 5 from the Application Client to the device server. A parameter list length of zero
specifies that no data shall be transferred.
3641 11.3.23.2 Send Diagnostic Command Data Transfer

3642 The SEND DIAGNOSTIC command will transfer out the number of bytes specified by the Parameter List
3643 Length. If that value is zero then no data out transfer will occur.
3644 The Device Server will request the transfer the specified bytes from the Application Client by issuing a
3645 series READY TO TRANSFER UPIU (RTT) followed by a DATA OUT UPIU containing the number of
3646 bytes to transfer.
3647
Page 202
3648 11.3.23.3 Send Diagnostic Command Status Response

3650  If the requested diagnostics are performed successfully then the command will terminate with a
3651 STATUS response of GOOD.
3654  Other failures can occur for numerous reasons. When the SEND DIAGNOSTIC command fails, a
3656 KEY, such as
3661 o Etc.
3662
Page 203
3663 11.3.24 SYNCHRONIZE CACHE (10) Command

3664 The SYNCHRONIZE CACHE (10) command requests that the device server ensure that the specified
3665 logical blocks have their most recent data values recorded on the medium.
3666 Table 11.44 — SYNCHRONIZE CACHE Command Descriptor Block
Bit
7 6 5 4 3 2 1 0
Byte
1 Reserved SYNC_NV IMMED Obsolete
2 (MSB)
3
4
5 (LSB)
7 (MSB)
NUMBER OF LOGICAL BLOCKS
8 (LSB)
9 CONTROL = 00h
3667
3668
Page 204
3669 11.3.24.1 Synchronize Cache Command Parameters

3670 Table 11.45 — Synchronize Cache Command Parameters
SYNC_NV: SYNC_NV is defined per SBC. Since non-volatile cache support is not
1 2 currently defined in this standard, the SYNC_NV parameter value in the CDB is
ignored by the UFS Device Server.
IMMED: An immediate (IMMED) bit set to zero specifies that the device server shall
not return status until the operation has been completed. An IMMED bit set to one
specifies that the device server shall return status as soon as the CDB has been
1 1 validated. If the IMMED bit is set to one, and the device server does not support the
IMMED bit, then the device server shall terminate the command with CHECK
CONDITION status with the sense key set to ILLEGAL REQUEST and the additional
sense code set to INVALID FIELD IN CDB.
LOGICAL BLOCK ADDRESS: The LOGICAL BLOCK ADDRESS field specifies the
LBA of the first logical block accessed by this command. If the specified LBA
exceeds the capacity of the medium, then the device server shall terminate the
2:5 7:0
command with CHECK CONDITION status with the sense key set to ILLEGAL
REQUEST and the additional sense code set to LOGICAL BLOCK ADDRESS OUT
OF RANGE.
GROUP NUMBER: The GROUP NUMBER field specifies the group into which
attributes associated with the command should be collected. A GROUP NUMBER
field set to zero specifies that any attributes associated with the command shall not
6 4:0
be collected into any group. The use of GROUP NUMBER field for SYNCHRONIZE
CACHE command is not defined in this specification therefore this field should be set
to zero.
NUMBER OF LOGICAL BLOCKS: The NUMBER OF LOGICAL BLOCKS field

specifies the number of logical blocks that shall be synchronized, starting with the
logical block specified by the LOGICAL BLOCK ADDRESS field. A NUMBER OF
LOGICAL BLOCKS field set to zero specifies that all logical blocks starting with the
one specified in the LOGICAL BLOCK ADDRESS field to the last logical block on the
7:8 7:0 medium shall be synchronized. If the LBA plus the number of logical blocks exceeds
the capacity of the medium, then the device server shall terminate the command with
CHECK CONDITION status with the sense key set to ILLEGAL REQUEST and the
additional sense code set to LOGICAL BLOCK ADDRESS OUT OF RANGE.
A logical block within the range that is not in cache is not considered an error.
CONTROL: The CONTROL byte is not used in this specification: the CONTROL
9 7:0
byte should be set to zero and it shall be ignored by UFS device.
3671
3672 11.3.24.2 Synchronize Cache Command Data Transfer
3673 The SYNCHRONIZE CACHE command does not have a data transfer phase.
3674  No DATA IN or DATA OUT UPIU’s are transferred.
Page 205
3675 11.3.24.3 Synchronize Cache Command Status Response

3677  If the command is performed successfully then it will terminate with a STATUS response of
3678 GOOD.
3681  Other failures can occur for numerous reasons. When the SYNCHRONIZE CACHE command
3682 fails, a STATUS response of CHECK CONDITION will be returned along with an appropriate
3683 SENSE KEY, such as
3688 o Etc.
3689
Page 206
3690 11.3.25 SYNCHRONIZE CACHE (16) Command

3691 See SYNCHRONIZE CACHE (10) command for details.
3692 Table 11.46 — SYNCHRONIZE CACHE (16) Command Descriptor Block
Bit
7 6 5 4 3 2 1 0
Byte
1 Reserved SYNC_NV IMMED Obsolete
2 (MSB)
… LOGICAL BLOCK ADDRESS
9 (LSB)
10 (MSB)
… NUMBER OF LOGICAL BLOCKS
13 (LSB)
15 CONTROL = 00h
3693
3694
Page 207
3695 11.3.26 UNMAP Command

3696 The UNMAP command shall require the device server to cause one or more LBAs to be unmapped (de-
3697 allocated).
3698 UFS defines that a logical unit shall be either Full Provisioning or Thin Provisioning as described in SCSI
3699 SBC. To use UNMAP command, SCSI SBC requires that a logical unit to be thin-provisioned and
3700 support logical block provisioning management. UNMAP command is not supported in a full-
3701 provisioned logical unit.
3702 In UFS, a thin provisioned logical unit shall have sufficient physical memory resources to support the
3703 logical block address space when the device is configured by the user. Mapped State and De-Allocated
3704 State are mandatory in a UFS thin provisioned logical unit.
3705 Table 11.47 — UNMAP Command Descriptor Block
Bit
7 6 5 4 3 2 1 0
Byte
1 Reserved ANCHOR
2 (MSB)
3
Reserved
4
5 (LSB)
7 (MSB)
PARAMETER LIST LENGTH
8 (LSB)
9 CONTROL = 00h
3706  GROUP NUMBER = ‘0’

3707  ANCHOR = 0 for UFS. If ANCHOR = 1, the device server shall terminate the command with
3708 CHECK CONDITION status with the sense key set to ILLEGAL REQUEST and the additional
3709 sense code set to INVALID FIELD IN CDB.
3710
Page 208
3711 11.3.26.1 UNMAP parameter list

3712 The UNMAP parameter list contains the data sent by an application client along with an UNMAP
3713 command. Included in the data are an UNMAP parameter list header and block descriptors for LBA
3714 extents to be processed by the device server for the UNMAP command. The LBAs specified in the block
3715 descriptors may contain overlapping extents, and may be in any order.
3716 Table 11.48 — UNMAP parameter list
Bit
7 6 5 4 3 2 1 0
Byte
0 (MSB)
UNMAP DATA LENGTH (n-1)
1 (LSB)
2 (MSB)
UNMAP BLOCK DESCRIPTOR DATA LENGTH (n-7)
3 (LSB)
4 (MSB)
…. Reserved
7 (LSB)
UNMAP block descriptors
8 (MSB)
…. UNMAP block descriptor (first)
23 (LSB)
n-15 (MSB)
… UNMAP block descriptor (last)
n (LSB)
3717  The UNMAP DATA LENGTH field specifies the length in bytes of the following data that is
3718 available to be transferred from the data-out buffer. The unmap data length does not include the
3719 number of bytes in the UNMAP DATA LENGTH field.
3720  The UNMAP BLOCK DESCRIPTOR DATA LENGTH field specifies the length in bytes of the
3721 UNMAP block descriptors that are available to be transferred from the data-out buffer. The unmap
3722 block descriptor data length should be a multiple of 16. If the unmap block descriptor data length is
3723 not a multiple of 16, then the last unmap block descriptor is incomplete and shall be ignored. If the
3724 UNMAP BLOCK DESCRIPTOR DATA LENGTH is set to zero, then no unmap block descriptors
3725 are included in the UNMAP parameter data. This condition shall not be considered an error.
Page 209
3726 11.3.26.2 UNMAP block descriptor

3727 Table 11.49 — UNMAP block descriptor
Bit
7 6 5 4 3 2 1 0
Byte
0 (MSB)
…. UNMAP LOGICAL BLOCK ADDRESS
7 (LSB)
8 (MSB)
…. NUMBER OF LOGICAL BLOCKS
11 (LSB)
12
…. Reserved
15
3728  The UNMAP LOGICAL BLOCK ADDRESS field contains the first LBA of the UNMAP block
3729 descriptor to be unmapped.
3730  The NUMBER OF LOGICAL BLOCKS field contains the number of LBAs to be unmapped
3731 beginning with the LBA specified by the UNMAP LOGICAL BLOCK ADDRESS field.
3732  To minimize performance degradation, the entire LBA region to be unmapped should be aligned with
3733 the bOptimalWriteBlockSize value in the Unit Descriptor where possible (but not required).
3734  If the NUMBER OF LOGICAL BLOCKS is set to zero, then no LBAs shall be unmapped for this
3735 UNMAP block descriptor. This condition shall not be considered an error.
3736  If the LBA specified by the UNMAP LOGICAL BLOCK ADDRESS field plus the number of logical
3737 blocks exceeds the capacity of the medium, then the device server shall terminate the command with
3738 CHECK CONDITION status with the sense key set to ILLEGAL REQUEST and the additional sense
3739 code set to LOGICAL BLOCK ADDRESS OUT OF RANGE.
3740  In UFS, if Vital Product Data Page is not supported by the UFS device, default values of MAXIMUM
3741 UNMAP LBA COUNT and MAXIMUM UNMAP BLOCK DESCRIPTOR COUNT are set as
3742 follows.
3743 o MAXIMUM UNMAP LBA COUNT = LBA count reported in READ CAPACITY
3744 o MAXIMUM UNMAP BLOCK DESCRIPTOR COUNT = 1
3745  If Vital Product Data Page is supported by the device, the MAXIMUM UNMAP LBA COUNT and
3746 MAXIMUM UNMAP BLOCK DESCRIPTOR COUNT are set by the device manufacturer in the
3747 Block Limits VPD page. If the total number of logical blocks specified in the UNMAP block
3748 descriptor data exceeds the value indicated in the MAXIMUM UNMAP LBA COUNT field in the
3749 Block Limits VPD page or if the number of UNMAP block descriptors exceeds the value of the
3750 MAXIMUM UNMAP BLOCK DESCRIPTOR COUNT field in the Block Limits VPD page, then the
3751 device server shall terminate the command with CHECK CONDITION status with the sense key set
3752 to ILLEGAL REQUEST and the additional sense code set to INVALID FIELD IN PARAMETER
3753 LIST.
Page 210
3754 11.3.27 READ BUFFER Command

3755 The READ BUFFER command is used in conjunction with the WRITE BUFFER command for
3756  testing logical unit buffer memory
3757  testing the integrity of the service delivery subsystem
3758  Downloading microcode
3759  Retrieving error history and statistics
3760  Tunneling commands and data
3761 The READ BUFFER command transfers a specified number of data bytes from a specified offset within a
3762 specified buffer in the Device Server to a buffer in the Application Client
3764 Table 11.50 — READ BUFFER Command
Bit
7 6 5 4 3 2 1 0
Byte
0 OPERATION CODE (3Ch)
1 Reserved MODE
2 BUFFER ID
3 (MSB)
4 BUFFER OFFSET
5 (LSB)
6 (MSB)
7 ALLOCATION LENGTH
8 (LSB)
9 CONTROL = 00h
3765
3766
Page 211
3767 11.3.27.1 Read Buffer Command Parameters

3768 Table 11.51 — Read Buffer Command Parameters
MODE: Specifies the function of this command. DATA MODE (02h) shall be
1 4:0
used to transfer UFS specific data. See table below for more detail.
BUFFER ID: Specifies a buffer within the logical unit. Buffer 0 shall be
2 7:0 supported. If more than one buffer is supported, then additional BUFFER ID
codes shall be assigned contiguously, beginning with one.
BUFFER OFFSET: Specifies the byte offset within the specified buffer from
3:5 7:0
which data shall be transferred.
ALLOCATION LENGTH: Specifies the maximum number of bytes of buffer
6:8 7:0
space that the Application Client has allocated for data reception.
3769
3770 11.3.27.2 Read Buffer Command Mode Field Values
3771 Table 11.52 — Read Buffer Command Mode Field Values
MODE DESCRIPTION
00h Not used in UFS
01h Vendor Specific
02h Data
03h-1Ch Not used in UFS
1Dh-1Fh Reserved
3772  For this version of UFS standard, the device shall support the MODE value of 02h, indicating
3773 Data Mode. Data Mode will transfer from the Device Server up to Allocation Length bytes,
3774 starting at Buffer Offset, of non-descript data from the buffer specified by Buffer ID.
3775  The definition and structure of the data being transferred in Data Mode will be described in other
3776 UFS documents that specify the functional description of the UFS specific extension operation
3777 that uses the READ BUFFER command.
3778 11.3.27.3 Read Buffer Command Data Transfer
3779  The Device Server will read up to Allocation Length number of data bytes from the specified
3780 Buffer Offset within a buffer specified by the Buffer ID in the Device Server and transfer them to
3781 a buffer in the Application Client
3782 o Less than Allocation Length will be transferred if Device Server contains less bytes
3783  Data will be transferred from the Device Server to the Application Client via a series of DATA
3784 IN UPIU’s
3785 o The data transferred from the Device Server will be contained within the Data Segment of the
3786 DATA IN UPIU
3787  Zero or an incomplete number of DATA IN UPIU’s will be transferred if an error occurs before
3788 the entire data transfer is complete
Page 212
3789 11.3.27.4 Read Buffer Command Status Response

3791  If all requested data is successfully read and transferred, the READ BUFFER command will
3795  Failure can occur for numerous reasons. When the READ BUFFER command fails a STATUS
3797 as
3802 o Etc.
3803
Page 213
3804 11.3.28 WRITE BUFFER Command

3805 The WRITE BUFFER command is used in conjunction with the READ BUFFER command for
3806  testing logical unit buffer memory
3807  testing the integrity of the service delivery subsystem
3808  Downloading microcode
3809  Retrieving error history and statistics
3810  Tunneling commands and data
3811 The WRITE BUFFER command transfers a specified number of data bytes from a buffer in the
3812 Application Client to a specified buffer in the Device Server at a specified buffer offset
3814 Table 11.53 — WRITE BUFFER Command
Bit
7 6 5 4 3 2 1 0
Byte
1 Reserved MODE
2 BUFFER ID
3 (MSB)
4 BUFFER OFFSET
5 (LSB)
6 (MSB)
7 PARAMETER LIST LENGTH
8 (LSB)
9 CONTROL = 00h
3815
3816
Page 214
3817 11.3.28.1 Write Buffer Command Parameters

3818 Table 11.54 — Write Buffer Command Parameters
MODE: Specifies the function of this command. DATA MODE (02h) shall be used to
1 4:0 transfer UFS specific data, and MODES 04h-07h, 0Eh-0Fh for microcode download. See
table below for more detail.
BUFFER ID: Specifies a buffer within the logical unit. Buffer 0 shall be supported. If more
2 7:0 than one buffer is supported, then additional BUFFER ID codes shall be assigned
contiguously, beginning with one.
BUFFER OFFSET: Specifies the byte offset within the specified buffer from which data
3:5 7:0
shall be transferred.
PARAMETER LIST LENGTH: Specifies the maximum number of bytes the Application
6:8 7:0
Client buffer will transfer to the Device Server.
3819 11.3.28.2 Write Buffer Command Mode Field Values

3820 Table 11.55 — Write Buffer Command Mode Field Values
MODE DESCRIPTION
00h Not used in UFS
01h Vendor Specific
02h Data
03h Not used in UFS
04h Download microcode and activate
05h Download microcode, save and activate
06h Download microcode with offsets and activate
07h Download microcode with offsets, save and activate
08h-0Dh Not used in UFS
0Eh Download microcode with offsets, save and defer activation
0Fh Activate deferred microcode
10h-1Ch Not used in UFS
1Dh-1Fh Reserved
3821  For this version of UFS standard, the device shall support the MODE value of 02h, indicating
3822 Data Mode. Data Mode will transfer from the Application Client Parameter List Length bytes of
3823 non-descript data destined for the Device Server for the buffer specified by Buffer ID at the offset
3824 specified by Buffer Offset.
3825  The definition and structure of the data being transferred in Data Mode will be described in other
3826 UFS documents that specify the functional description of the UFS specific extension operation
3827 that uses the WRITE BUFFER command.
3828  UFS device may support a MODE value of 04h-07h or 0Eh-0Fh for microcode download.
Page 215
3829 11.3.28.3 Write Buffer Command Data Transfer

3830 The Device Server will request transfer of the specified number of bytes from a buffer in the Application
3831 Client by issuing a series of READY TO TRANSFER UPIU’s (RTT) followed by a DATA OUT UPIU
3832 per RTT and will subsequently write those bytes to the specified Buffer Offset within the buffer specified
3833 by the Buffer ID in the Device Server
3834  The data transferred from the Application Client will be contained within the Data Segment of the
3835 DATA OUT UPIU
3838 11.3.28.4 Write Buffer Command Status Response
3840  If the requested data is successfully transferred and written, the WRITE BUFFER command will
3844  Failure can occur for numerous reasons. When the WRITE BUFFER command fails a STATUS
3846 as
3851 o Etc.
3852
Page 216
3853 11.4 Mode Pages

3854 This section describes the mode pages used with MODE SELECT command and MODE SENSE
3855 command. Subpages are identical to mode pages except that they include a SUBPAGE CODE field that
3856 further differentiates the mode page contents.
3857 11.4.1 Mode Page Overview
3858 11.4.1.1 Mode Page/Subpage Codes
3859  Mode pages and subpages are selected by Page Code field and the Subpage Code field
3860  UFS devices are not required to support no subpages (subpage = 0)
3861 Table 11-56 — Mode page code usage
Page Code Subpage Code Description Page Format
00h Vendor specific Vendor specific page Vendor specific format
Device specific STANDARD

00h Page 0 format
page (subpage 0)
01h to 1Fh 01h to DFh Device specific SUBPAGE Subpage format
(SCSI E0h to FEh Vendor specific SUBPAGE Subpage Format

SPECIFIC)
Return all SUBPAGES for the Page 0 format for subpage 00h,
FFh specified device specific subpage format for subpages 01h to
mode page FEh
Vendor specific STANDARD

00h Page 0 format
page (subpage 0)
20h to 3Eh
01h to FEh Vendor specific SUBPAGE Subpage format
(VENDOR
SPECIFIC) Return all SUBPAGES for the Page 0 format for subpage 00h,
FFh specified vendor specific subpage format for subpages 01h to
mode page FEh
Return all STANDARD pages

00h Page 0 format
(subpage 0)
3Fh
01h to FEh Reserved NA
(Return ALL
pages) Page 0 format for subpage 00h,
Return all subpages for all
FFh sub_page format for subpages 01h
mode pages
to FEh
3862
3863
Page 217
3864 11.4.1.2 Mode parameter list format

3865 General format for reading or writing mode pages.
3866 UFS will not implement Block Descriptor field
3867 Table 11.57 — UFS Mode parameter list
Bit
7 6 5 4 3 2 1 0
Byte
Mode Parameter Header
Block Descriptor(s)
Mode Page(s) or Subpages or Vendor specific pages
3868 11.4.1.3 Mode Parameter Header

3869 The mode parameter header that is used by the MODE SELECT (10) command and the MODE SENSE
3870 (10) command is defined in the following table.
3871 Table 11.58 — UFS Mode parameter header (10)
Bit
7 6 5 4 3 2 1 0
Byte
0 (MSB)
MODE DATA LENGTH
1 (LSB)
2 MEDIUM TYPE = 00h
DEVICE SPECIFIC PARAMETER

3
WP Reserved = 00b DPOFUA Reserved = 0000b
4 Reserved = 00h
5 Reserved = 00h
6 (MSB)
BLOCK DESCRIPTOR LENGTH
= 00h
7 (LSB)
3872 When using the MODE SENSE command, the MODE DATA LENGTH field indicates the length in
3873 bytes of the following data that is available to be transferred. The mode data length does not include the
3874 number of bytes in the MODE DATA LENGTH field. When using the MODE SELECT command, this
3875 field is reserved.
3876
Page 218
3877 11.4.1.4 Mode Parameter Header Detail

3878 Table 11.59 — Mode Parameter Header Detail
MODE DATA LENGTH: Indicates the length in bytes of data following this field that is
0:1 7:0 available to transfer. This value does not include the size of this field (2 bytes). For MODE
SENSE 10-byte CDB, this value will be calculated as 6 + page data bytes.
MEDIUM TYPE: Indicates the medium type of the device. For UFS this value shall be set
2 7:0
to 00h, indicating Data Medium.
DEVICE SPECIFIC PARAMETER: Direct access device specific value.

This field contains the write protect (WP) bit: a WP bit set to one indicates that the
medium is write-protected, a WP bit set to zero indicates that the medium is not write-
protected.
3 7:0 When used with the MODE SELECT command, the DPOFUA bit is reserved.
When used with the MODE SENSE command, a DPOFUA bit set to zero indicates that the
device server does not support the DPO and FUA bits.
When used with the MODE SENSE command, a DPOFUA bit set to one indicates that the
device server supports the DPO and FUA bits
BLOCK DESCRIPTOR LENGTH: Length of block descriptor in parameter list. For UFS
6:7 7:0 this value shall be 00h indicating that there is no block descriptor(s) used in the parameter
list.
3879 NOTE 1 The WP bit shall be set to one when the logical unit is write-protected by any method, including any one of
3880 the followings:
3881  the software write protect (SWP) bit in the Control mode page is set to one
3882  the logical unit is configured as permanent write protected and fPermanentWPEn = 1
3883  the logical unit is configured as power on write protected and fPowerOnWPEn = 1
3884  the device is write-protected by vendor-specific electrical or mechanical mechanism.
3885
Page 219
3886 11.4.1.5 Page_0 mode page format

3887 Table 11.60 — Page_0 mode page format
Bit
7 6 5 4 3 2 1 0
Byte
SPF
0 PS PAGE CODE
(0b)
1 PAGE LENGTH (n – 1)
2
Mode Parameters
n
3888
3889 Table 11.61 — Page 0 Format parameters
PS: Indicates the page parameters can be saved. When using the MODE SENSE
command, the PS bit set to one indicates that the mode page may be saved by the logical
0 7:7 unit in a nonvolatile, vendor specific location. A PS bit set to zero indicates that the device
server is not able to save the supported parameters. When using the MODE SELECT
command, the PS bit is reserved.
SPF: Indicates SUBPAGE format. When set to zero indicates that the PAGE 0 format is
0 6:6
being used. When set to one, indicates the SUBPAGE mode page format is being used.
0 5:0 PAGE CODE: Indicates the format and parameters for particular mode page.
1 7:0 PAGE LENGTH: Indicates the size in bytes of the following mode page parameters.
2:N 7:0 MODE PARAMETERS: The contents of the indicated mode page.
3890
3891
Page 220
3892 11.4.1.6 Sub_page mode page format

3893 Table 11.62 — Sub_page mode page format
Bit
7 6 5 4 3 2 1 0
Byte
0 PS SPF (1b) PAGE CODE
1 SUBPAGE CODE
2 (MSB)
PAGE LENGTH (n – 3)
3 (LSB)
4
Mode Parameters
n
3894
3895 Table 11.63 — Subpage Format parameters
PS: Indicates the page parameters can be saved. When using the MODE SENSE command,
the PS bit set to one indicates that the mode page may be saved by the logical unit in a
0 7:7 nonvolatile, vendor specific location. A PS bit set to zero indicates that the device server is
not able to save the supported parameters. When using the MODE SELECT command, the
PS bit is reserved.
SPF: Indicates SUBPAGE format. When set to zero indicates that the PAGE 0 format is
0 6:6
being used. When set to one, indicates the SUBPAGE mode page format is being used.
PAGE CODE: Page and Subpage code indicates the format and parameters for particular
0 5:0
mode page.
SUBPAGE CODE: Page and subpage code indicates the format and parameters for
1 7:0
particular mode page.
2:3 7:0 PAGE LENGTH: Indicates the size in bytes of the following mode page parameters.
4:N 7:0 MODE PARAMETERS: The contents of the indicated mode page.
3896
Page 221
3897 11.4.2 UFS Supported Pages

3898 Table 11.64 shows the mode pages supported by UFS device. This standard does not define any
3899 additional subpages.
3900 Table 11.64 — UFS Supported Pages
PAGE SUBPAGE
PAGE NAME DESCRIPTION
CODE CODE
CONTROL 0Ah 00h Return CONTROL mode page
READ-WRITE
ERROR 01h 00h Return READ-WRITE ERROR RECOVERY mode page
RECOVERY
CACHING 08h 00h Return CACHING mode page
ALL PAGES 3Fh 00h Return all mode pages (not including subpages)
ALL SUBPAGES 3Fh FFh Return all mode pages and subpages
3901
3902 If the device has more than one logical unit, host should read Mode Page Policy VPD in order to know
3903 whether the logical unit maintains its own copy of the mode page and subpage or all logical units share
3904 the mode page and subpage.
Page 222
3905 11.4.2.1 Control Mode Page

3906 The Control mode page provides controls over SCSI features that are applicable to all device types (e.g.,
3907 task set management and error logging).
3908 Table 11.65 defines the Control mode page default value (PC = 10b).
3909 Table 11.65 — Control Mode Page default value
Bit
7 6 5 4 3 2 1 0
Byte
SPF
0 PS PAGE CODE = 0Ah
=0
1 PAGE LENGTH (0Ah)
TMF_ONL D_SENS
DPICZ GLTSD RLEC
2 TST = 000b Y E
= 0b = 0b = 0b
= 0b = 0b
QUEUE ALGORITHM MODIFIER NUAR QERR Obsolete

3
= 0001b = 0b = 00b = 0b
VS RAC UA_INTLCK_CTRL SWP Obsolete

4
= 0b = 0b = 00b = 0b = 000b
Reserve
ATO TAS ATMPE RWWP AUTOLOAD MODE
5 d
= 0b = 0b = 0b = 0b = 000b
= 0b
6
Obsolete
= 0000h
7
8 (MSB)
BUSY TIMEOUT PERIOD
9 (LSB)
10 (MSB)
EXTENDED SELF-TEST COMPLETION TIME
= 0000h
11 (LSB)
3910 NOTE 1 Default values for PS field and BUSY TIMEOUT PERIOD field are device specific.
3911
3912 The following Control mode page fields shall be changeable: SWP and BUSY TIMEOUT PERIOD.
3913 Other fields may or may not be changeable, refer to the vendor datasheet for details.
3914
Page 223
3915 11.4.2.2 Control Mode Page Parameters

3916 Table 11.66 — Control Mode Page Parameters
TST: Indicates Task Set Type.

1 7:5 000b indicates the logical unit maintains one task set for all I_T nexuses.
Others: reserved.
SWP: A software write protect (SWP) bit set to one specifies that the logical unit shall
inhibit writing to the medium after writing all cached or buffered write data, if any. When
4 3:3
SWP is one, all commands requiring writes to the medium shall be terminated with CHECK
CONDITION status, with the sense key set to DATA PROTECT
BUSY TIMEOUT PERIOD: The BUSY TIMEOUT PERIOD field specifies the maximum
time, in 100 milliseconds increments, that the application client allows for the device server
8:9 7:0
to return BUSY status for commands from the application client. A 0000h value in this field
is undefined. An FFFFh value in this field is defined as an unlimited period.
3917 NOTE 1 In addition to the software write protection, the logical unit may be configured as permanent write protected
3918 or power on write protected. The logical unit is writeable if all types of write protection are disabled. The logical unit is
3919 write protected if SWP = 1b, or if it is configured as permanent write protected and fPermanentWPEn =1, or if it is
3920 configured as power on write protected and fPowerOnWPEn =1.
3921
3922
Page 224
3923 11.4.2.3 Read-Write Error Recovery Mode Page

3924 The Read-Write Error Recovery mode page specifies the error recovery parameters the device server shall
3925 use during any command that performs a read or write operation to the medium (e.g., READ command,
3926 WRITE command, or VERIFY command).
3927 Table 11.67 defines the Read-Write Error Recovery mode page default value (PC = 10b).
3928 Table 11.67 — Read-Write Error Recovery Mode Page default value
Bit
7 6 5 4 3 2 1 0
Byte
SPF
0 PS PAGE CODE = 01h
=0b
1 PAGE LENGTH = 0Ah
AWRE ARRE TB RC EER PER DTE DCR

2
= 1b = 0b = 0b = 0b = 0b = 0b = 0b = 0b
3 READ RETRY COUNT
4 Obsolete = 00h
5 Obsolete = 00h
6 Obsolete = 00h
Restricted for MMC-

TPERE
7 Reserved = 00000b 6
= 0b
= 00b
8 WRITE RETRY COUNT
9 Reserved = 00h
10 (MSB)
RECOVERY TIME LIMIT
11 (LSB)
3929 NOTE 1 Default values for PS field, READ RETRY COUNT field, WRITE RETRY COUNT field and RECOVERY
3930 TIME LIMIT are device specific.
3931 This standard does not define which Read-Write Error Recovery mode page fields are changeable, refer to
3932 vendor datasheet for details.
3933
Page 225
3934 11.4.2.4 Read-Write Error Recovery Parameters

3935 Table 11.68 — Read-Write Error Recovery Parameters
READ RETRY COUNT: The READ RETRY COUNT field specifies the number of times
3 7:0
that the device server shall attempt its recovery algorithm during read operations.
WRITE RETRY COUNT: The WRITE RETRY COUNT field specifies the number of times
8 7:0
that the device server shall attempt its recovery algorithm during write operations.
RECOVERY TIME LIMIT: The RECOVERY TIME LIMIT field specifies in milliseconds the
maximum time duration that the device server shall use for data error recovery
10:11 7:0
procedures. When both a retry count and a recovery time limit are specified, the field that
specifies the recovery action of least duration shall have priority.
3936
3937
Page 226
3938 11.4.2.5 Caching Mode Page

3939 The Caching mode page defines the parameters that affect the use of the cache. A UFS device shall
3940 implement support for following parameters.
3941 Table 11.69 defines the Caching mode page default value (PC = 10b).
3942 Table 11.69 — Caching Mode Page default value
Bit
7 6 5 4 3 2 1 0
Byte
SPF
0 PS PAGE CODE = 08h
= 0b
1 PAGE LENGTH (12h)
IC ABPF CAP DISC SIZE WCE MF RCD
2
= 0b = 0b = 0b = 0b = 0b =1b = 0b =0b
DEMAND READ RETENTION PRIORITY WRITE RETENTION PRIORITY
3
= 0000b = 0000b
4 (MSB) DISABLE PRE-FETCH TRANSFER LENGTH
5 = 0000h (LSB)
6 (MSB) MINIMUM PRE-FETCH
7 = 0000h (LSB)
8 (MSB) MAXIMUM PRE-FETCH
9 = 0000h (LSB)
10 (MSB) MAXIMUM PRE-FETCH CEILING
11 = 0000h (LSB)
FSW LBCSS DRA Vendor Specific Reserved NV_DIS
12
= 0b = 0b = 0b = 00b = 00b = 0b
13 NUMBER OF CACHE SEGMENTS = 00h
14 (MSB) CACHE SEGMENT SIZE
15 = 0000h (LSB)
16 Reserved = 00h
17
18 Obsolete = 000000h
19
3943 The following Caching mode page fields shall be changeable: WCE and RCD. Other fields mayor may
3944 not be changeable, refer to the vendor datasheet for details.
3945
Page 227
3946 11.4.2.6 Caching Mode Page Parameters

3947 Table 11.70 — Caching Mode Page Parameters
WCE: WRITE BACK CACHE ENABLE. A writeback cache enable bit set to zero specifies
that the device server shall complete a WRITE command with GOOD status only after
2 2:2 writing all of the data to the medium without error. A WCE bit set to one specifies that the
device server may complete a WRITE command with GOOD status after receiving the
data without error and prior to having written the data to the medium.
RCD: READ CACHE DISABLE. A read cache disable bit set to zero specifies that the
device server may return data requested by a READ command by accessing either the
2 0:0 cache or medium. A RCD bit set to one specifies that the device server shall transfer all of
the data requested by a READ command from the medium (i.e., data shall not be
transferred from the cache).
3948 NOTE 1 Fields that are not supported by UFS should be set to zero, and are documented assigning a value of zero
3949 to them (e.g., PS=0b). The device may ignore values in fields that are not supported by UFS.
3950
3951
Page 228
3952 12 UFS SECURITY
3953 This section summarizes UFS device security features and the implementation details. These features
3954 include: Secure mode operation, data and register protection, RPMB and reset.
3955 12.1 UFS Security Feature Support Requirements
3956 The security features outlined in this specification are mandatory for all devices.
3957 The following security features are defined: replay protected memory block (RPMB), secure mode and
3958 different types of logical unit write protection.
3959 12.2 Secure Mode
3960 12.2.1 Description
3961 UFS devices will be used to store user’s personal and/or corporate data information. The UFS device
3962 provides a way to remove the data permanently from the device when requested, ensuring that it cannot
3963 be retrieved using reverse engineering on the memory device.
3964 The UFS device shall support a secure and insecure mode of operation. In the secure mode all operations
3965 that result in the removal or retiring of information on the device will purge this information in a secure
3966 manner, as outlined in 12.2.2.1 “Secure Removal”.
3967 The secure mode is applied at the logical unit level, so different logical unit may have different secure
3968 modes.
3969
Page 229
3970 12.2.2 Requirements

3971 12.2.2.1 Secure Removal
3972 The way in which data is removed securely from the device is dependent on the type of memory
3973 technology that is used to implement the UFS device. Three common methods that apply to most
3974 memory types implemented at the time of this spec are:
3975 1. The device controller shall issue an erase operation to the addressed location.
3976 2. The device controller shall overwrite the addressed locations with a single character and erase the
3977 device.
3978 3. The device controller shall overwrite the addressed locations with a character, its complement,
3979 then a random character
3980 UFS device manufacturers are required to support the secure removal method required for their specific
3981 flash media.
3982 12.2.2.2 Erase Operation
3983 Erase is an operation that moves data from the mapped address space to the unmapped address space.
3984 The regions in the mapped address space where erase was applied will be set to the erased value of zero.
3985 This operation places no requirement on what the device is required to do with the data in the unmapped
3986 address space. After an erase is executed, software on the host should not be able to retrieve the erased
3987 data.
3988 The minimum data range that an erase operates on is the smallest region that can be written.
3989 12.2.2.3 Discard Operation
3990 Discard is a non-secure variant of the erase functionality. The distinction between discard and erase is the
3991 device behavior where the device is not required to guarantee that host would not retrieve the original
3992 data from one or more LBA’s that were marked for discard when a read operation is directed to the
3993 LBA’s.
3994 12.2.2.4 Purge Operation
3995 The Purge operation operates on the unmapped address space. When the operation is executed it results
3996 in removing all the data from the unmapped address space. This is done in accordance with the
3997 bSecureRemovalType parameter value of the Device Descriptor. This mode allows the host system to
3998 protect against die level attacks.
3999
Page 230
4000 12.2.3 Implementation

4001 12.2.3.1 Erase
4002 The erase functionality is implemented using the UNMAP command and it is enabled if the
4003 bProvisioningType parameter in the Unit Descriptor is set to 03h (TPRZ = 1).
4004 The device behavior shall comply with the UNMAP definition in [SBC] when the TPRZ bit in the READ
4005 CAPACITY(16) parameter data is set to one.
4006 As defined in [SBC],
4007  The UNMAP command causes a mapped LBA to transition from mapped state to deallocated
4008 state if an unmap operation completes without error.
4009  Since the TPRZ bit is set to one if the erase functionality is enabled, a READ command
4010 specifying a deallocated LBA shall return zero.
4011  The device server may maintain a deallocated LBA in deallocated state until a write operation
4012 specifying that LBA is completed without error.
4013  Or, the device server may transition a deallocated LBA from deallocated state to mapped state at
4014 any time (autonomous state transition). For UFS, if TPRZ bit is set to one and an autonomous
4015 transition to the mapped state occurs, the LBA shall be mapped to a physical block(s) containing
4016 data with all bits set to zero.
4017 LBA’s to be erased may be aligned to multiples of the dEraseBlockSize parameter value, where it is
4018 possible, to minimize performance impact. dEraseBlockSize is a parameter included in the Unit
4019 Descriptor.
4020 12.2.3.2 Discard
4021 The discard functionality is implemented using the UNMAP command and it is enabled if the
4022 bProvisioningType parameter in the Unit Descriptor is set to 02h (TPRZ = 0). The device behavior shall
4023 comply with the UNMAP definition in [SBC] when the TPRZ bit in the READ CAPACITY(16)
4024 parameter data is set to zero.
4025 As defined in [SBC],
4026  The UNMAP command causes a mapped LBA to transition from mapped state to deallocated
4027 state if an unmap operation completes without error.
4028  Since the TPRZ bit is set to zero if the discard functionality is enabled, a READ command
4029 specifying a deallocated LBA may return any data..
4030  The device server may maintain a deallocated LBA in deallocated state until a write operation
4031 specifying that LBA is completed without error.
4032  Or, the device server may transition a deallocated LBA from deallocated state to mapped state at
4033 any time (autonomous state transition). For UFS, if TPRZ bit is set to zero and an autonomous
4034 transition to the mapped state occurs, the LBA shall be mapped to a physical block(s) containing
4035 any data including the original data before UNMAP operation.
4036 LBA’s to be discard may align to multiples of the dEraseBlockSize where possible to minimize
4037 performance impact. dEraseBlockSize is a parameter included in the Unit Descriptor.
4038
Page 231
4039 12.2.3.3 Purge operation

4040 The purge operation is implemented via Query Functions with Attributes and Flags. In particular, the
4041 fPurgeEnable flag allows to enable or disable the execution of a purge operation, and the bPurgeStatus
4042 attribute provides information about the operation status.
4043  fPurgeEnable flag
4044 o Write only volatile flag, set to zero after power on or reset.
4045 o Purge operation is enabled when this flag is equal to one, otherwise it is disabled.
4046 o This flag can only be set when the command queue of all logical units are empty.
4047 o This flag is automatically cleared by the UFS device when the operation completes or an error
4048 condition occurs.
4049 o This flag can be cleared by the host to interrupt an ongoing purge operation.
4050  bPurgeStatus attribute
4051 o Read only attribute.
4052 o This attribute can be set to one of the following values:
4053 - 00h: Idle (purge operation disabled).
4054 - 01h: Purge operation in progress.
4055 - 02h: Purge operation stopped prematurely by the host.
4056 - 03h: Purge operation completed successfully.
4057 - 04h: Purge operation failed due to logical unit queue not empty
4058 - 05h: Purge operation general failure.
4059 Other values are reserved and shall not be set.
4060 o bPurgeStatus is set to 00h (Idle) after power on or reset.
4061 o When the host enables the purge operation setting fPurgeEnable flag to one, and if all logical unit
4062 command queue are empty, the bPurgeStatus will be set to 01h to indicate that the purge
4063 operation is in progress. The bPurgeStatus shall be set to 03h if the operation is completed
4064 successfully, or to 05h if a failure occurred.
4065 o If the host attempts to enable the purge operation when there is at least one logical unit with
4066 command queue not empty, the setting of fPurgeEnable flag shall fail, Query Response field in
4067 the QUERY RESPONSE UPIP shall be set to FFh (“General Failure”), the purge operation shall
4068 not start, and the bPurgeStatus shall be set to 04h.
4069 o If an ongoing purge operation is interrupted by the host setting the fPurgeEnable flag to zero, the
4070 bPurgeStatus shall be set to 02h.
4071 o When the bPurgeStatus is equal to the values 02h, 03h, 04h or 05h, the bPurgeStatus shall be
4072 automatically cleared to 00h (Idle) the first time that it is read. The bPurgeStatus values of 00h
4073 and 01h shall not be modified as a result of a read.
4074  If the purge operation is in progress (bPurgeStatus = 01h) any commands placed into the logical unit
4075 queue will fail. The device shall return the sense key ”NOT READY” to show that the command
4076 failed because a purge operation was in progress.
Page 232
4077 12.2.3.3 Purge operation (cont’d)

4078  If the host needs to execute a command urgently when a purge operation is in progress, it may
4079 interrupt the purge operation. In particular, before issuing any command, the host sets fPurgeEnable
4080 flag to zero, waits until the device interrupts the operation, and then sets the bPurgeStatus attribute to
4081 02h (purge operation stopped prematurely).
4082  If a power failure occurs the fPurgeEnable flag and bPurgeStatus attribute shall be reset to zero. In
4083 this case the device will not indicate that operation failed.
4084 Figure 12.1 shows the Purge operation state machine. There are two states: “Idle” and “Purge Op. in
4085 progress”.
4086 After power on, the purge operation state is “Idle”, and the purge operation is disabled.
4087 To enable the execution of a purge operation, the host sets fPurgeEnable flag to one sending a QUERY
4088 REQUEST UPIU. If the setting is executed successfully, the state will transition to “Purge Op. in
4089 progress” and the purge operation will start (bPurgeStatus = 01h). If there is a least one logical unit with
4090 command queue not empty, the setting of fPurgeEnable flag shall fail, the purge operation shall not start,
4091 the state shall remain “Idle”, and bPurgeStatus shall be set to 04h.
4092 When the purge operation is completed, the state will transition automatically to “Idle”, and bPurgeStatus
4093 shall be set to 03h if the operation is completed successfully, or 05h in case of failure.
State bPurgeStatus
Power-on
Idle 00h, 02h, 03h, 04h, 05h
Set fPurgeEnable / Purge op.
Fail 01h
in progress
(1)
Transition Description
Idle
Set fPurgeEnable and LU
1
command queues not empty
Set fPurgeEnable and LU
2
command queues empty
Set fPurgeEnable / 3 Clear fPurgeEnable
(4) (2)
Success
Automatic transition when the
4 purge operation completes
(3)
successfully or with failure
Purge op.
Purge op. completed / in progress Clear fPurgeEnable /
Success or Fail Success Input / Output
State
4094
4095 Figure 12.1 — Purge operation state machine
4096 NOTE 1 On each transition the input event (triggering the state transition) and the output of the transition itself are
4097 mentioned
4098 The host may interrupt an ongoing purge operation clearing the fPurgeEnable flag, when the operation
4099 has been interrupted the state will transition to “Idle” and bPurgeStatus will be set to 02h.
Page 233
4100 12.2.3.4 Wipe Device

4101 The wipe device operation is fulfilled issuing the FORMAT UNIT command to all enabled logical units.
4102 If the logical unit is permanently write protected and fPermanentWPEn flag is one, or power on write
4103 protected and fPowerOnWPEn flag is one, the FORMAT UNIT command shall fail and the content of the
4104 medium shall not be altered.
4105 The FORMAT UNIT command combines the activities of erase and purge operations. The fields of the
4106 FORMAT UNIT command should be set as described in the following:
4107  The Format data (FMTDATA) bit shall be set to zero to specify that no parameter list will be
4108 provided.
4109  The DEFECT LIST FORMAT shall be set to 000b.
4110  The format protection information (FMTPINFO) shall be set to 00b.
4111  The vendor specific byte shall be set to 00h.
4112 The UFS device shall ignore CMPLST and LONGLIST bits since FMTDATA is set to zero.
4113
4114 12.2.3.5 bProvisioningType Parameter
4115 Logical units can be configured in secure mode using bProvisioningType parameter of the Unit
4116 Descriptor. This parameter allows to enable thin provisioning and define TPRZ bit value in the READ
4117 CAPACITY parameter data.
4118 The secure mode is enabled if thin provisioning is enabled and TPRZ bit is equal to one. In this mode all
4119 operations shall be performed using the mode defined by bSecureRemovalType parameter in the Device
4120 Descriptor. Only one type of removal type can be defined for an entire device.
4121 bProvisioningType parameter can be set to the following values:
4122  00h: to disable thin provisioning
4123  02h: to enable thin provisioning and set TPRZ to zero
4124  03h: to enable thin provisioning and set TPRZ to one
4125 TPRZ bit value of zero indicates the device is in normal mode.
4126 bProvisioningType shall be set once during system integration writing the Configuration Descriptor.
4127
4128
Page 234
4129 12.2.3.6 bSecureRemovalType Parameter

4130 The bSecureRemovalType parameter within the Device Descriptor defines how information is removed
4131 from the physical memory during a Purge operation. This parameter can be set once during system
4132 integration writing the Configuration Descriptor. bSecureRemovalType values are defined as follows: .
4133  Value of ‘03h’ will result in the information being removed using a vendor defined mechanism.
4134  Value of ’02h’ will result in all information being removed by overwriting the addressed locations
4135 with a character, its complement, then a random character.
4136  Value of ‘01h’ will result in all information being removed by overwriting the addressed locations
4137 with a single character followed by an erase.
4138  Value of ‘00h’ will result in all information being removed by an erase of the physical memory
4139 (default).
4140  Other values are reserved for future use and shall not be set.
4141 Device manufacturers are only required to support the mechanism required by their memory array
4142 technology.
4143 For additional information please refer to the http://www.killdisk.com/dod.htm or to the following
4144 documents for more details:
4145 o DoD 5220.22-M (http://www.dtic.mil/whs/directives/corres/pdf/522022m.pdf) and
4146 o NIST SP 800-88 (http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.pdf)
4147
Page 235
4148 12.3 Device Data Protection

4149 12.3.1 Description and Requirements
4150 UFS device data content can be protected at the logical unit level. The following protection modes shall
4151 be available:
4152  Permanent write protection (permanent: once enabled it cannot be reversed)
4153  Power on write protection (write protection can be cleared with a power cycle or a hardware reset
4154 event)
4155 These modes of write protections are not implemented in the RPMB well known logical unit.
4156 There shall also be a method to read the protection mode that is currently enabled for a logical unit.
4157 The order of protection mode priority is set as:
4158 1. Permanent
4159 2. Power On
4160 3. No protection
4161 Protection regions smaller than logical unit are not supported in this version of the standard.
4163 The protection mode can be defined at logical unit level configuring the bLUWriteProtect parameter of
4164 the Unit Descriptor. The write protection modes are encoded as shown below:
4165 00h: Logical unit not write protected
4166 01h: Logical unit power on write protected
4167 02h: Logical unit permanently write protected
4168 A power on write protected logical unit (bLUWriteProtect = 01h) can be written only if fPowerOnWPEn
4169 flag is equal to zero. The fPowerOnWPEn flag is set to zero after a power cycle or hardware reset event,
4170 once it is set to one it cannot be toggled or cleared by the host.
4171 The fPermanentWPEn flag shall be set to one to enable the write protection of all permanently write
4172 protected logical unit (bLUWriteProtect = 02h); logical unit can be written if fPermanentWPEn flag is
4173 equal to 0b. The fPermanentWPEn flag is write once: it cannot be toggled or cleared once it is set. For
4174 embedded devices, fPermanentWPEn flag shall be zero after device manufacturing.
4175 It is recommended to set fPowerOnWPEn flag or fPermanentWPEn flag when all command queues are
4176 empty, and wait device query response before enqueuing write command.
Page 236
4177 12.4 RPMB

4178 12.4.1 Description
4179 A signed access to a Replay Protected Memory Block is provided. This function provides means for the
4180 system to store data to the specific memory area in an authenticated and replay protected manner. This is
4181 provided by first programming authentication key information to the UFS device memory (shared secret).
4182 As the system cannot be authenticated yet in this phase the authentication key programming have to take
4183 in a secure environment like in an OEM production. Further on the authentication key is utilized to sign
4184 the read and write accesses made to the replay protected memory area with a Message Authentication
4185 Code (MAC).
4186 Usage of random number generation and count register are providing additional protection against replay
4187 of messages where messages could be recorded and played back later by an attacker.
4188
4189 12.4.2 RPMB Well Known Logical Unit Description
4190 The RPMB is contained in a unique well known logical unit whose size is defined in the RPMB Unit
4191 Descriptor. RPMB well known logical unit size shall be a multiple of 128 KByte, therefore its minimum
4192 size is 128 KByte. The contents of the RPMB well known logical unit can only be read and written via
4193 successfully authenticated read and write accesses. The data may be overwritten by the host but can
4194 never be erased.
4195 All accesses to the RPMB will reference the specific RPMB well known logical unit number (W-LUN).
4196
4197
Page 237
4198 12.4.3 Requirements

4199 12.4.3.1 Memory Map of RPMB LU
4200  Authentication Key
4201 o Type: Write once, not erasable or readable
4202 o Size: 32 Bytes
4203 o Description: Authentication key register which is used to authenticate accesses when
4204 MAC is calculated.
4205  Write Counter
4206 o Type: Read only
4207 o Size: 4 Bytes
4208 o Description: Counter value for the total amount of successful authenticated data write
4209 requests made by the host. The initial value of this register after production is 0000
4210 0000h. The value will be incremented by one automatically by the UFS device along
4211 with each successful programming access. The value cannot be reset. After the counter
4212 has reached the maximum value of FFFF FFFFh, it will not be incremented anymore
4213 (overflow prevention).
4214  RPMB Data Area
4215 o Type: Readable and writable
4216 o Multiples of 128 KBytes defined in RPMB Unit Descriptor
4217  128 KBytes min., 16 MBytes max.
4218 o Description: Data which can only be read and written via successfully authenticated
4219 read/write access. This data may be overwritten by the host but can never be erased.
4220
4221 12.4.3.2 Algorithm and Key for MAC Calculation
4222 The message authentication code (MAC) is calculated using HMAC SHA-256 as defined in [HMAC-
4223 SHA]. The HMAC SHA-256 calculation takes as input a key and a message. The resulting MAC is 256
4224 bits (32 Byte), which are embedded in the data frame as part of the request or response.
4225 The key used for the MAC calculation is always the 256 bit Authentication Key stored in the UFS device.
4226 The message used as input to the MAC calculation is the concatenation of the fields in the RPMB packet.
4227 MAC calculation includes a 16 Byte nonce (random number) generated by the host.
4228 Reference:
4229 [HMAC-SHA] Eastlake, D. and T. Hansen, "US Secure Hash Algorithms (SHA and HMAC-
4230 SHA)", RFC 4634, July 2006.
4231
Page 238
4232 12.4.3.3 RPMB Message Components

4233 Each RPMB message includes specific components. These components are displayed in Table 12.1.
4234 Table 12.1 — RPMB Message Components
Required Required
Component Name Length for for Description
Requests Responses
Request Message Type Yes Yes

or 2 Bytes See 12.4.3.4 and 12.4.3.5
Response Message Type (Request) (Response)
Authentication Key Yes

or Yes
32 Bytes (Key or
Message Authentication (MAC)
Code (MAC) MAC)
Result 2 Bytes No Yes See 12.4.3.6
Total amount of successful

Write Counter 4 Bytes Yes Yes
authenticated data write requests.
Address of data to be programmed

to or read from the RPMB. Address
Address 2 Bytes Yes Yes
is the serial number of the half
sector (256 Bytes).
Random number generated by the

Nonce 16 Bytes Yes Yes host for the requests and copied to
response by the RPMB engine.
Data to be written or read by signed

Data 256 Bytes Yes Yes
access.
Number of blocks (256 Bytes)

Block Count 2 Bytes Yes Yes requested to be read or
programmed.
4235
4236
Page 239
4237 12.4.3.4 Messages from Host to Device

4238 The following message types are defined to support RPMB. These messages will be sent from the UFS
4239 host to the UFS device.
4240  Authentication Key Programming request
4241  Read Write Counter value
4242  Authenticated data write request
4243  Authenticated data read request
4244  Result Read Request
4245
4246 Table 12.2 — Request Message Types
Request Message Types
0001h Authentication key programming request
0002h Reading of the Write Counter value request
0003h Authenticated data write request
0004h Authenticated data read request
0005h Result read request
4247 12.4.3.5 Messages from Device to Host

4248 The following message types are defined to support RPMB. These messages will be sent to the host from
4249 the device.
4250  Authentication key programming response
4251  Write Counter value (response to request)
4252  Authenticated Data write response
4253  Authenticated Data read response
4254
4255 Table 12.3 — Response Message Types
Response Message Types
0100h Authentication key programming response
0200h Reading of the Write Counter value response
0300h Authenticated data write response
0400h Authenticated date read response

Page 240
4256 12.4.3.6 RPMB Operation Result

4257  RPMB Operation Result is composed by two bytes. The most significant byte is reserved and
4258 shall be set to zero.
4259  The bit 7 of RPMB Operation Result shall indicate if the write counter has expired (i.e., reached
4260 its max. value) or not
4261 o Value of one will represent an expired write counter
4262 o Value of zero will represent a valid write counter
4263  The other bits shall indicate the operation status
4264 o Operation Okay (00h)
4265 o General Failure (01h)
4266 o Authentication Failure (02h)
4267  MAC comparison not matching, MAC calculation failure
4268 o Counter Failure (03h)
4269  Counters not matching in comparison, counter incrementing failure
4270 o Address Failure (04h)
4271  Address out of range, wrong address alignment
4272 o Write Failure (05h)
4273  Data, Counter or result write failure
4274 o Read Failure (06h)
4275  Data, Counter or result write failure
4276 o Authentication key not yet programmed (07h)
4277  This value is the only valid result until the authentication key has been programmed (after
4278 which it can never occur again)
4279
4280 Table 12.4 — RPMB Operation Result data structure
Bit[15:8] Bit[7] Bit[6:0]
Reserved Write Counter Status Operation Status

4281
4282
Page 241
4283 12.4.3.6 RPMB Operation Result (cont’d)

4284
4285 Table 12.5 — RPMB Operation Results
Operation Results (The values in parenthesis are valid when Write Counter has expired)
0000h (0080h) Operation OK
0001h (0081h) General failure
0002h (0082h) Authentication failure (MAC comparison not matching, MAC calculation failure)
0003h (0083h) Counter failure (counters not matching in comparison, counter incrementing failure)
0004h (0084h) Address failure (address out of range, wrong address alignment)
0005h (0085h) Write failure (data/counter/result write failure)
0006h (0086h) Read failure (data/counter/result read failure)
Authentication Key not yet programmed. This value is the only valid Result value
0007h until the Authentication Key has been programmed. Once the key is programmed,
this Result value will no longer be used.
4286
Page 242

4288 12.4.4.1 Data Frame for RPMB Message
4289 RPMB Message Data Frame size is 512 Bytes and it is organized as shown in Table 12.6.
4290 Table 12.6 — RPMB Message Data Frame
Bit
7 6 5 4 3 2 1 0
Byte
0 (MSB)
Stuff Bytes
195 (LSB)
196 (MSB)
Key / MAC
227 (LSB)
228 Data [255]
483 Data [0]
484 (MSB)
Nonce
499 (LSB)
500 (MSB)
Write Counter
503 (LSB)
504 (MSB)
Address
505 (LSB)
506 (MSB)
Block Count
507 (LSB)
508 (MSB)
Result
509 (LSB)
510 (MSB)
Request / Response
511 (LSB)
4291
Page 243
4292 12.4.4.2 MAC Calculation

4293 The key used for the MAC calculation is always the 256 bit Authentication Key stored in the device.
4294 Input to the MAC calculation is the concatenation of the fields in the RPMB message data frame
4295 excluding stuff bytes and the MAC itself – i.e., bytes [228:511] of the data frame in that order.
4296 If several data frames are sent as part of one request or response then the input message to MAC is the
4297 concatenation of bytes [228:511] of each data frame in the order in which the data frames are sent. The
4298 MAC is added only to the last data frame.
4299
4300 12.4.4.3 RPMB Message Data Frame Delivery
4301 The RPMB functions will be implemented by using SCSI security protocol commands (SECURITY
4302 PROTOCOL IN and SECURITY PROTOCOL OUT) to deliver the RPMB message data frames between
4303 the host and device.
4304
4305 12.4.5 SECURITY PROTOCOL IN/OUT Commands
4306 Security Protocol In/Out commands described in [SPC] are used to encapsulate and deliver data packets
4307 of any security protocol between host and UFS device without interpreting, dis-assembling or re-
4308 assembly the data packets for delivery.
4309 The Security Protocol In/Out commands contain a Security Protocol field. A unique Security Protocol ID
4310 is assigned by T10 for JEDEC UFS application.
4311  Security Protocol = ECh for JEDEC UFS application
4312 This standard further assigns unique identifiers in the Security Protocol Specific field of the Security
4313 In/Out commands for RPMB and all other future security protocols used in UFS application.
4314  RPMB Protocol ID = 0001h
4315
4316
Page 244
4317 12.4.5.1 CDB format of SECURITY PROTOCOL IN/OUT Commands

4318 Table 12.7 — CDB format of Security Protocol In/Out commands
Bit
7 6 5 4 3 2 1 0
Byte
(1)
0 OPERATION CODE
1 SECURITY PROTOCOL
2
3
INC_512
4 Reserved
= 0b
5 Reserved
6 (MSB)
(2)
ALLOCATION / TRANSFER LENGTH
9 (LSB)
10 Reserved
11 CONTROL = 00h
4319 NOTE 1 OPERATION CODE = A2h for SECURITY PROTOCOL IN command, OPERATION CODE = B5h for
4320 SECURITY PROTOCOL OUT command.
4321 NOTE 2 ALLOCATION LENGTH for SECURITY PROTOCOL IN command, TRANSFER LENGTH for SECURITY
4322 PROTOCOL OUT command.
4323
4324 Security Protocol In/Out commands shall consider the unique Security Protocol ID assigned to JEDEC
4325 UFS application as the only valid Security Protocol ID.
4326 INC_512 bit shall be set to zero to specify that the ALLOCATION / TRANSFER LENGTH field
4327 expresses the number of bytes to be transferred.
4328
4329
Page 245
4330 12.4.5.2 Security Protocol Information Description

4331 As required by [SPC], the SECURITY PROTOCOL value of 00h shall be supported if the SECURITY
4332 PROTOCOL IN command is supported by the device. The security protocol information security protocol
4333 (i.e., the SECURITY PROTOCOL field set to 00h in a SECURITY PROTOCOL IN command) is used to
4334 transfer security protocol related information from the target logical unit.
4335 When the SECURITY PROTOCOL field is set to 00h in a SECURITY PROTOCOL IN command, the
4336 two bytes SECURITY PROTOCOL SPECIFIC field shall contain a numeric value as defined below.
4337
4338 Table 12.8 — Security Protocol specific field values
Security Protocol Specific Field Value Description Support
CDB Byte 2 CDB Byte 3
00h 00h Supported security protocol list Mandatory
00h 01h Certificate data Mandatory
Other values Reserved
4339
4340
Page 246
4341 12.4.5.3 Supported security protocols list description

4342 According to [SPC], if the SECURITY PROTOCOL field is set to 00h and the SECURITY PROTOCOL
4343 SPECIFIC field is set to 0000h in a SECURITY PROTOCOL IN command, the parameter data shall have
4344 the format shown in Table 12.9.
4345 Table 12.9 — Supported security protocols SECURITY PROTOCOL IN parameter data
Bit
7 6 5 4 3 2 1 0
Byte
0
Reserved
5
6 (MSB)
SUPPORTED SECURITY PROTOCOL LIST LENGTH (m-7)
7 (LSB)
8 SUPPORTED SECURITY PROTOCOL [first] (00h)
.
.
m SUPPORTED SECURITY PROTOCOL [last]
m+1
Pad Bytes (optional)
n
4346 Security Protocol 00h and the UFS Security Protocol ID = ECh are the only valid security protocol ID’s
4347 supported in this version of the standard, therefore Table 12.9 shall be implemented as defined in Table
4348 12.10.
4349 Table 12.10 — UFS Supported security protocols SECURITY PROTOCOL IN parameter data
Bit
7 6 5 4 3 2 1 0
Byte
0
Reserved
5
6 (MSB)
0002h (SUPPORTED SECURITY PROTOCOL LIST LENGTH)
7 (LSB)
8 00h (SECURITY PROTOCOL 00h)
9 ECh (UFS SECURITY PROTOCOL)
10
n
4350
4351
Page 247
4352 12.4.5.4 Certificate data description

4353 If the SECURITY PROTOCOL field is set to 00h and the SECURITY PROTOCOL SPECIFIC field is
4354 set to 0001h in a SECURITY PROTOCOL IN command, the parameter data shall have the format shown.
4355 Table 12.11 — Certificate data SECURITY PROTOCOL IN parameter data
Bit
7 6 5 4 3 2 1 0
Byte
0
Reserved
1
2 (MSB)
CERTIFICATE LENGTH (m-3)
3 (LSB)
4
CERTIFICATE
m
m+1
n
4356 The Device Server does not have a certificate to transfer, the CERTIFICATE LENGTH field shall be set
4357 to 0000h. therefore Table 12.11 shall be implemented as defined in Table 12.12.
4358 Table 12.12 — UFS certificate data SECURITY PROTOCOL IN parameter data
Bit
7 6 5 4 3 2 1 0
Byte
0
Reserved
1
2 (MSB)
0000h (CERTIFICATE LENGTH)
3 (LSB)
4
n
4359
Page 248
4360 12.4.6 RPMB Operations

4361 12.4.6.1 Request Type Message Delivery
4362  Host sends Request type message to UFS device to request an operation by the UFS device or to
4363 deliver data to be written into the RPMB memory block.
4364  To deliver a Request type message, the host sends the Security Protocol Out command in a
4365 COMMAND UPIU in the command phase of a SCSI transaction.
4366  The maximum data size in a single Authenticated Data Write request is equal to
4367 bRPMB_ReadWriteSize × 256 bytes; multiple Authenticated Data Write operations should be
4368 executed if the data size exceeds this value.
4369 Table 12.13 — Security Protocol Out command
COMMAND UPIU
Flags.W = 1
xx00 0001b LUN Task Tag
Flags.R = 0
Command Set
Type (0h)
Security Protocol Out CDB
4370  The Expected Data Transfer Length shall be set the values defined in Table 12.14.
4371
4372 Table 12.14 — Expected Data Transfer Length value for Request Type Messages
RPMB Data Frame Value
Authentication Key Data,

Result Register Read Request,
512
Write Counter Read Request,
Data Read Request
Program Data Request 512 × Block Count
4373
4374  The device indicates to the host that it is ready for the operation by returning a READY TO
4375 TRANSFER UPIU.
Page 249
4376 12.4.6.1 Request Type Message Delivery (cont’d)

4377 Table 12.15 — Ready To Transfer
READY TO TRANSFER UPIU
Data Buffer Offset = 0
Data Transfer Count = 512
Reserved
Reserved
Reserved
4378  The entire RPMB message data frame is then delivered to the device by a DATA OUT UPIU in
4379 the Data Phase.
4380 Table 12.16 — RPMB message data frame
DATA OUT UPIU
Total EHS Length (00h) Reserved Data Segment Length = 512
Reserved
Reserved
Reserved
RPMB Data Frame (512B)

Page 250
4381 12.4.6.1 Request Type Message Delivery (cont’d)

4382  To complete the operation, the device returns a RESPONSE UPIU with the status of the operation
4383 in the Status Phase.
4384 Table 12.17 — RESPONSE UPIU
RESPONSE UPIU
Command Set
Type (0h)
Residual Transfer Count
Reserved
Reserved
Reserved
Reserved
… … … …

4385
Page 251
4386 12.4.6.2 Response Type Message Delivery

4387  Host sends Response type message to UFS device to read the result of a previous operation
4388 request, to read the Write Counter, or to read data from the RPMB memory block.
4389  To deliver a Response type message, the host sends the Security Protocol In command in a
4390 COMMAND UPIU in the Command Phase of a SCSI transaction.
4391  The maximum data size in a single Authenticated Data Read request is equal to
4392 bRPMB_ReadWriteSize × 256 bytes; multiple Authenticated Data Read operations should be
4393 executed if the data size exceeds this value.
4394
4395 Table 12.18 — Response Type Message Delivery: COMMAND UPIU
COMMAND UPIU
Flags.W = 0
xx00 0001b LUN Task Tag
Flags.R = 1
Command Set
Type (0h)
Security Protocol In CDB
4396  The Expected Data Transfer Length shall be set the value shows in Table 12.19.
4397
4398 Table 12.19 — Expected Data Transfer Length value for Response Type Messages
RPMB Data Frame Value
Response for Result Register Read Request,

512
Response for Write Counter Read Request
Data Read Response 512 × Block Count
4399
4400
Page 252
4401 12.4.6.2 Response Type Message Delivery (cont’d)

4402  The device returns the result or data requested in the RPMB message. The entire RPMB message
4403 data frame is delivered from the device to the host in a DATA IN UPIU in the Data Phase.
4404 Table 12.20 — Response Type Message Delivery: DATA IN UPIU
DATA IN UPIU
Total EHS Length (00) Reserved Data Segment Length = 512
Reserved
Reserved
Reserved
RPMB Data Frame (512B)
4405
4406  To complete the operation, the device sends a RESPONSE UPIU with the status of the operation
4407 in the Status Phase.
4408
Page 253
4409 12.4.6.2 Response Type Message Delivery (cont’d)

4410
4411 Table 12.21 — Response Type Message Delivery: RESPONSE UPIU
RESPONSE UPIU
Command Set
Type (0h)
Total EHS Length (00h) Reserved Data Segment Length = 0
Residual Transfer Count = 0
Reserved
Reserved
Reserved
Reserved
… … … …

4412
Page 254
4413 12.4.6.3 Authentication Key Programming

4414  The Authentication Key programming is initiated by a Security Protocol Out command
4415  The RPMB data frame delivered from the host to the device includes the Request Message Type
4416 = 0001h and the Authentication Key
4417  The device returns “Good” status in status response when Authentication Key programming is
4418 completed
4419  Host initiates the Authentication Key programming verification process by issuing a Security
4420 Protocol Out command with delivery of a RPMB data frame contains the Request Message Type
4421 = 0005h
4422  The device returns “Good” status in status response when the verification result is ready for
4423 retrieval
4424  Host retrieves the verification result by issuing a Security Protocol In command
4425  Device returns the RPMB data frame containing the Response Message Type = 0100h and the
4426 Result code
4427 If programming of Authentication Key fails then returned result is 0005h (Write failure). If some
4428 other error occurs during Authentication Key programming then returned result is 0001h (General
4429 failure).
4430 Access to Reply Protected Memory Block is not allowed/possible before Authentication Key is
4431 programmed. The state of the device can be checked by trying to write/read data to/from the
4432 Replay Protected Memory Block and then reading the result register. If the Authentication Key is
4433 not yet programmed then message 0007h (Authentication Key not yet programmed) is returned in
4434 result field.
4435
Page 255
4436 12.4.6.3 Authentication Key Programming (cont’d)
UFS Host UFS Device
COMMAND (Security Protocol Out) Authentication Key Data
Offset Field Name Value

0 :195 Stuff bytes 0...00h
196:227 MAC / Key Key to be programmed
228:483 Data 0...00h
READY TO TRANSFER
484:499 Nonce 0...00h
500:503 Write counter 0000 0000h
504:505 Address 0000h
DATA OUT (RPMB Message)
506:507 Block Count 0000h
508:509 Result 0000h
510:511 Request/Response 0001h (Request)
RESPONSE
Result Register Read Request
COMMAND (Security Protocol Out) Offset Field Name Value

196:227 MAC / Key 0...00h
228:483 Data 0...00h
484:499 Nonce 0...00h
READY TO TRANSFER 500:503 Write counter 0000 0000h
504:505 Address 0000h
DATA OUT (RPMB Message) 508:509 Result 0000h
Response for Result Read Register Request

RESPONSE
COMMAND (Security Protocol In) 196:227 MAC / Key 0...00h

228:483 Data 0...00h
484:499 Nonce 0...00h
504:505 Address 0000h
DATA IN (RPMB Message)
508:509 Result Result code
RESPONSE
510:511 Request/Response 0100h (Response)
4437
4438 Figure 12.2 — Authentication Key Programming Flow
4439
Page 256
4440 12.4.6.4 Read Counter Value

4441  The Read Counter Value sequence is initiated by a Security Protocol Out command
4443 = 0002h and the Nonce.
4444  When the host received a “Good” status in the status response from the device, it sends a Security
4445 Protocol In command to the device to retrieve the Counter value
4446  The device returns a RPMB data frame with Response Message Type = 0200h, a copy of the
4447 Nonce received in the request, the Write Counter value, the MAC and the Result
4448 If reading of the counter value fails then returned result is 0006h (Read failure).
4449 If some other error occurs then Result is 0001h (General failure).
4450 If counter has expired also bit 7 is set to 1 in returned results (Result values 0080h, 0086h and
4451 0081h, respectively).
UFS Host UFS Device
COMMAND (Security Protocol Out) Write Counter Read Request

196:227 MAC / Key 0...00h
228:483 Data 0...00h
READY TO TRANSFER
Nonce generated by
484:499 Nonce
the host
DATA OUT (RPMB Message) 504:505 Address 0000h
508:509 Result 0000h
RESPONSE
Response for Write Counter Read Request
COMMAND(Security Protocol In)
MAC generated by
196:227 MAC / Key
the device
228:483 Data 0...00h
Copy of the Nonce
484:499 Nonce
generated by the host
DATA IN (RPMB Message) Current Write Counter
500:503 Write counter
value
504:505 Address 0000h
RESPONSE
508:509 Result Result code
4452
4453 Figure 12.3 — Read Counter Value Flow
Page 257
4454 12.4.6.5 Authenticated Data Write

4455  The Authenticated Data Write sequence is initiated by a Security Protocol Out command
4457 = 0003h, Block Count, Address, Write Counter, Data and MAC
4458 o When the device receives this RPMB message data frame, it first checks whether the write
4459 counter has expired. If the write counter is expired then the device sets the result to 0085h
4460 (write failure, write counter expired). No data is written to the RPMB data area.
4461 o Next the address is checked. If the Address value is equal or greater than
4462 qLogicalBlockCount parameter value in the RPMB Unit Descriptor, then the result is set to
4463 0004h (address failure). No data are written to the RPMB data area.
4464 o If the write counter was not expired then the device calculates the MAC of request type,
4465 block count, write counter, address and data, and compares this with the MAC in the request.
4466 If the two MAC’s are different, then the device sets the result to 0002h (authentication
4467 failure). No data are written to the RPMB data area.
4468 o If the MAC in the request and the calculated MAC are equal then the device compares the
4469 write counter in the request with the write counter stored in the device. If the two counters are
4470 different then the device sets the result to 03h (counter failure). No data are written to the
4471 RPMB data area.
4472 o If the MAC and write counter comparisons are successful then the write request is considered
4473 to be authenticated. The data from the request are written to the address indicated in the
4474 request and the write counter is incremented by one.
4475 o If write fails then returned result is 0005h (write failure).
4476 o If some other error occurs during the write procedure then returned result is 0001h (General
4477 failure).
4478 o In multiple block write case the MAC is included only to the last packet n, the n-1 packets
4479 will include a value of zero. In every packet the address is the start address of the full access
4480 (not address of the individual block) and the block count is the total count of the blocks (not
4481 the block numbers).
4482  The device returns “Good” status in status response when Authenticated Data Write operation is
4483 completed regardless of whether the Authenticated Data Write is successful or not.
4484  The successfulness of the programming of the data shall be checked by the host by reading the
4485 result register of the RPMB. Host initiates the Authenticated Data Write verification process by
4486 issuing a Security Protocol Out command with delivery of a RPMB data frame contains the
4487 Request Message Type = 0005h
4488  The device returns “Good” status in status response when the verification result is ready for
4489 retrieval
4490  Host retrieves the verification result by issuing a Security Protocol In command
4491  Device returns the RPMB data frame containing the Response Message Type = 0300h, the
4492 incremented counter value, the data address, the MAC and result of the data programming
4493 operation.
4494
Page 258
4495 12.4.6.5 Authenticated Data Write (cont’d)
UFS Host UFS Device
Program Data Request

COMMAND (Security Protocol Out)
MAC generated by the
196:227 MAC / Key
host
READY TO TRANSFER 228:483 Data Data to be written
484:499 Nonce 0...00h
Current Write counter
500:503 Write counter
value
DATA OUT (RPMB Message) 504:505 Address Address in the RPMP LU
506:507 Block Count Number of 256B blocks
508:509 Result 0000h
RESPONSE
Result Register Read Request

196:227 MAC / Key 0...00h
228:483 Data 0...00h
READY TO TRANSFER 484:499 Nonce 0...00h
504:505 Address 0000h
DATA OUT (RPMB Message) 506:507 Block Count 0000h
508:509 Result 0000h
RESPONSE
Response for Result Register Read Request
COMMAND (Security Protocol In)
MAC generated by the
196:227 MAC / Key
device
228:483 Data 0...00h
484:499 Nonce 0...00h
Incremented Write
DATA IN (RPMB Message) 500:503 Write counter
counter value
504:505 Address Address in RPMB LU
RESPONSE 508:509 Result Result code
4496
4497 Figure 12.4 — Authenticated Data Write Flow
Page 259
4498 12.4.6.6 Authenticated Data Read

4499  The Authenticated Data Read sequence is initiated by a Security Protocol Out command
4501 = 0004h, the nonce, the data address, and the block count.
4502 o When the device receives this request it first checks the address. If the Address value is equal
4503 or greater than qLogicalBlockCount parameter value in the RPMB Unit Descriptor, then
4504 result is set to 0004h (address failure). The data read is not valid.
4505 o After successful data fetch the MAC is calculated from response type, nonce, address, data
4506 and result. If the MAC calculation fails then returned result is 0002h (Authentication failure).
4507  When the host received a “Good” status in the status response from the device, it sends a Security
4508 Protocol In command to the device to retrieve the data
4509  The device returns a RPMB data frame with Response Message Type (0400h), the block count, a
4510 copy of the nonce received in the request, the data address, the data itself, the MAC and the result
4511  In multiple block read case, the MAC is included only to the last packet n, the n-1 packets will
4512 include a value of zero. In every packet the address is the start address of the full access (not
4513 address of the individual block) and the block count is the total count of the blocks (not the
4514 sequence number of blocks).
4515  If data fetch from addressed location inside device fails then returned result is 0006h (Read
4516 failure). If some other error occurs during the read procedure then returned result is 0001h
4517 (General failure).
4518
Page 260
4519 12.4.6.6 Authenticated Data Read (cont’d)
UFS Host UFS Device
Data Read Request

196:227 MAC / Key 0...00h
228:483 Data 0...00h
READY TO TRANSFER Nonce generated by
484:499 Nonce
the host
DATA OUT (RPMB Message) 504:505 Address Address in RPMB LU

508:509 Result 0000h
RESPONSE Data Read Response

COMMAND (Security Protocol In) MAC generated by the
196:227 MAC / Key
device
Data read from the
228:483 Data
RPMB LU
Copy of the Nonce
484:499 Nonce
generated by the host
DATA IN (RPMB Message)
504:505 Address Address in RPMB LU
RESPONSE 508:509 Result Result code
4520
4521 Figure 12.4 — Authenticated Read Flow
4522
4523 12.5 Malware Protection
4524 The UFS device will also have the option to protect boot, bus configuration settings and other important
4525 device configuration settings so that once they are set they cannot be modified. The implementation of
4526 the protection of these parameters is defined within the spec where the parameter is defined.
4527 12.6 Mechanical
4528 Packaging and requirements for UFS embedded device should adhere to the following guidelines if
4529 possible
4530  Reset and data transfer pins should be located in the second (PoP) or third row (MCP) in from the
4531 side of the package to prevent access.
4532
Page 261
4533 13 UFS FUNCTIONAL DESCRIPTIONS
4534 13.1 UFS Boot

4535 13.1.1 Introduction
4536 Some computing systems can have the need to download the system boot loader from an external non-
4537 volatile source. This task can be accomplished through an internal boot ROM contained in the host SOC
4538 whose code when executed determines a minimal initialization of the system to start the boot code
4539 transfer.
4540 Several features of the boot functionality can be configured in order to be adapted to different system
4541 requirements.
4542 Moreover specific features to ensure boot data integrity and no corruption of boot code are defined.
4543 13.1.2 Boot Configuration
4544 During boot operation the UFS host controller retrieves the system boot code stored in single embedded
4545 UFS device.
4546 In this version of the standard, the boot mechanism is defined for a point-to-point topology (see Figure
4547 13.1).
4548 NOTE Only the embedded UFS device supports the boot feature.
Host SOC
DRAM DRAM
Host Controller
CPU
UFS Host UFS

Controller
Device
Downstream communication
Upstream communication
Figure 13.1 — UFS System Diagram
4549
4550 Two logical units (Boot LU A, Boot LU B) can be used to store the boot code, but only one of them will
4551 be active during the boot process. Any logical unit can be configured as “Boot LU A” or “Boot LU B”.
4552 No more than one logical unit may be configured as “Boot LU A”, and no more than one logical unit may
4553 be configured as “Boot LU B”. The logical unit that is active during boot is mapped onto the Boot well
4554 known logical unit (W-LUN = 30h) for read access. In this way it is maintained a fix logical unit number
4555 when the active logical unit is swapped from A to B or vice versa, when the host updates the boot code.
4556
Page 262
4557 13.1.2 Boot Configuration (cont’d)

4558 Several fields of Device Descriptor and Unit Descriptors shall be configured to define the device behavior
4559 during boot. Device Descriptor and Unit Descriptors are configured writing the Configuration Descriptor.
4560 For a UFS bootable device, the bBootEnable field in the Device Descriptor shall be set to 01h to enable
4561 the boot process.
4562 The user shall configure the logical units used for the boot feature by writing the corresponding Unit
4563 Descriptor configurable parameters within the Configuration Descriptor. In particular the logical unit size
4564 shall be defined through the Number of Allocation Blocks field, and the LUN shall be associated to “Boot
4565 LU A” or “Boot LU B” through the bBootLunID field.
4566 The logical unit active during the boot shall be configured writing the bBootLunEn attribute, as described
4567 in Table 13.1.
4568 Table 13.1 — bBootLunEn Attribute
bBootLunEn Description
Boot LU A = disabled
00h
Boot LU B = disabled
Boot LU A = enabled
01h
Boot LU B = disable
Boot LU A = disable
02h
Boot LU B = enabled
Others Reserved
4569 The host should not attempt to set bBootLunEn to ‘Reserved’ values, and UFS device shall generate an
4570 error in case of an attempt to set ‘Reserved’ values and not execute the request.
4571 When bBootLunEn attribute is 00h the boot feature is disabled, the device behaves as if bBootEnable
4572 would be equal to zero.
4573 The active boot logical unit will be mapped onto the Boot well known boot logical unit (W-LUN = 30h)
4574 once the bBootLunEn has been properly configured.
4575 Figure 13.2 shows an example of an UFS device having eight logical units: LU 1 and LU 4 are
4576 configured, respectively, as “Boot LU A” and “Boot LU B”. In particular, LU 1 is the active one
4577 (bBootLunEn = 01h).
4578
Page 263
4579 13.1.2 Boot Configuration (cont’d)
UFS Device
LU0
bBootLunEn = 01h.
”Boot LU A” is the active LU1  Boot LU A LU1  bBootLunId = 01h
logical unit for boot.
It is mapped onto the Boot
LU2
well known logical unit
(W-LUN=30h, LUN field in
UPIU = B0h). LU3
LU4  Boot LU B LU4  bBootLunId = 02h
LU5
LU6
LU7
Figure 13.2 — Example of UFS Device Memory Organization for Boot

4580
4581
Page 264
4582 13.1.3 Initialization and boot code download process

4583 The initialization and boot code download process is made up of the following phases: partial
4584 initialization, boot transfer and initialization completion.
4585 13.1.3.1 Partial initialization
4586 The partial initialization phase starts after power on, or hardware reset, or EndPointReset and involves the
4587 entire UFS stack. At the end of this phase, the UniPro boot sequence shall be completed, and the UTP
4588 layer shall be capable of accessing Device Descriptor (if the bDescrAccessEn field of the Device
4589 Descriptor is ‘01h’) and exchanging UPIU for READ command and TEST UNIT READY command. If
4590 the bDescrAccessEn field is ‘00h‘ descriptors will be accessible only after the initialization completion
4591 phase.
4592 Each single layer in the UFS protocol stack executes the initialization process on both UFS host and UFS
4593 device sides.
4594 Physical Layer (M-PHY)
4595 After reset events, the physical layer will move from DISABLED state to LOW SPEED BURST state.
4596 Link Layer (UniPro)
4597 On host and device side UniPro boot sequence takes place:
4598 1. The UniPro stack is reset using the DME_RESET.req primitive.
4599 2. Wait until the reset completion is indicated by the DME_RESET.cnf_L primitive.
4600 3. The UniPro stack is enabled using the DME_ENABLE.req primitive.
4601 4. Wait until the enable completion is indicated by the DME_ENABLE.cnf_L primitive.
4602 5. The UniPro Link StartUp sequence is initiated using the DME_LINKSTARTUP.req primitive.
4603 The UniPro Link Startup consists of a series of multiphase handshakes to establish initial link
4604 communication in both directions between UFS host and device.
4605 6. Wait until the link startup completion is indicated by the DME_LINKSTARTUP.cnf_L primitive.
4606 UFS Transport Layer (UTP)
4607 At the end of the UFS Interconnect Layer initialization on both host and device side, the host shall send a
4608 NOP OUT UPIU to verify that the device UTP Layer is ready.
4609 For some implementations, the device UTP layer may not be initialized yet, therefore the device may not
4610 respond promptly to NOP OUT UPIU sending NOP IN UPIU.
4611 The host waits until it receives the NOP IN UPIU from the device. When the NOP IN UPIU is received,
4612 the host is acknowledged that the UTP layer on the device is ready to execute UTP transactions.
4613 Link Configuration
4614 The host may configure the Link Attributes (i.e., Gear, HS Serie, PWM Mode in Rx and Tx) by DME
4615 primitives at UniPro level.
4616 Device Descriptor Reading
4617 The UFS host may optionally discover relevant device info for the boot process by accessing the Device
4618 Descriptor (i.e., Device Class/Subclass, Boot Enable, Boot LUs size, etc.). The UFS host is allowed to
4619 access the Device Descriptor only if the bDescrAccessEn is ‘01h’, otherwise this descriptor can be
4620 accessed only after the device has fully completed its initialization.
Page 265
4621 13.1.3.2 Boot transfer

4622 The following steps can be executed only if bBootEnable field is set.
4623 Boot code download
4624 Firstly, the UFS host issues a TEST UNIT READY command to the Boot well known logical unit to
4625 verify if the latter can be accessed. If the command succeeds, the UFS host reads the Boot well known
4626 logical unit by issuing SCSI READ commands and the UFS device will start to send the boot code on the
4627 Upstream Link. During this phase only the Boot well known logical unit is accessible: this logical unit
4628 shall accept read commands, while other logical units may not be ready.
4629 13.1.3.3 Initialization completion
4630 After the host has completed the boot code download from the Boot well known logical unit, the
4631 initialization process proceeds as described in the following. The host sets the fDeviceInit flag to “01h” to
4632 communicate to the UFS device that it can complete its initialization. The device shall reset the
4633 fDeviceInit flag when the initialization is complete. The host polls the fDeviceInit flag to check the
4634 completion of the process. When the fDeviceInit is reset, the device is ready to accept any command.
4635
Page 266
4636 13.1.3.3 Initialization completion (cont’d)
No active tasks in the device

UFS Host UFS Device
UFS Descriptors, Attributes and
Flags set to their default value
UniPro attributes reset
Power-on Reset / HW Reset / EndPointReset
M-PHY layer initialization on both sides

shall lead to PWM-G1 speed gear
UniPro Boot sequence and

Attributes configuration
NOP OUT
The host sends a NOP OUT UPIU.

The device responds with a NOP IN UPIU
NOP IN
UFS host queries the UFS device Descriptor

Opt. Query Request(READ DESCRIPTOR)  bDeviceClass/bDeviceSubClass – Mass
Storage Bootable Device
 bBootEnable – Boot process enabled
 bBootLunEn – LU configured for Boot
Query Response (Device Descriptor)  bBootSeqID – RFU
This operation is optional and allowed only if
bDescrAccessEn is equal to one.
Opt. TEST UNIT READY (Boot LU) The host issues a TEST UNIT READY to
check if the Boot W-LU is operational.
LOOP
This operation is optional if the host does

not read the Boot W-LU.
Status The device clears established UAC after
the device reports UNIT ATTENTION with
CHECK CONDITION status to the host.
SCSI READ (Boot LU)
DATA Host reads the boot code from the Boot well
known logical unit by issuing one or more
Status SCSI READ commands
Query Request (SET FLAG fDeviceInit)
The host enables the device initialization

Query Response completion by setting fDeviceInit flag.
Query Request(READ FLAG fDeviceInit)

fDeviceInit flag is polled by the host to verify
LOOP
the device initialization completion.

At the end of the initialization process,
Query Response (fDeviceInit) fDeviceInit shall be reset by the device
4637
4638 Figure 13.3 — Device Initialization and Boot Procedure Sequence Diagram
4639
Page 267
4640 13.1.3.3 Initialization completion (cont’d)

4641 Table 13.2 — Valid UPIUs and SCSI Commands for Each Initialization Phase
Phase Event Valid UPIU Valid SCSI command
Before Power On Reset / HW

None None
Initialization Reset / EndPointReset
M-PHY layer initialization

UIC Layer
UniPro Boot sequence and
Initialization None None
UIC Layer Attributes
Phase
configuration
Receive a single NOP OUT

UTP Layer UPIU
NOP OUT UPIU
Initialization Send NOP IN UPIU for None
Phase NOP IN UPIU
response to NOP OUT
UPIU
Read Device Descriptor QUERY REQUEST UPIU

(1)
(READ DESCRIPTOR None
Boot W-LU (Optional) Device Descriptor)
Ready
Phase INQUIRY, REQUEST
(Optional) (2) COMMAND UPIU for Boot SENSE, TEST UNIT
Boot Transfer (Optional)
W-LU READY, READ (6),
(3)
READ (10), READ (16)
Receive QUERY QUERY REQUEST UPIU

Application REQUEST UPIU (SET (SET FLAG fDeviceInit to
Layer FLAG fDeviceInit to ‘01h’) ‘01h’)
None
Initialization Send QUERY RESPONSE QUERY REQUEST UPIU
Phase UPIU with fDeviceInit = (READ FLAG fDeviceInit)
‘00h’ QUERY RESPONSE UPIU
Device
initialization Any supported SCSI
Any normal operation Any supported UPIU
completed commands
Phase
4642 NOTE1 Device Descriptor may be read only if bDescrAccessEn is set to ‘01h’.
4643 NOTE2 Boot well-known logical unit may be read if bBootEnable is set to ‘01h’, at least one logical unit is
4644 configured for boot (bBootLunEn) and bBootLunID selects the desired boot logical unit.
4645 NOTE3 READ (16) command support is optional.
4646
4647 13.1.4 Initialization process without boot code download
4648 If the boot process is not enabled on the UFS device, or it is not supported by the device class, or the host
4649 does not need to transfer the boot code, the host executes the initialization process as described in 13.1.3,
4650 omitting the boot transfer phase.
Page 268
4651 13.1.5 Boot Logical Unit Operations

4652 The Boot well known logical unit is read only, therefore the boot code can be stored only writing the boot
4653 logical units (A or B).
4654 Boot logical units are written to store the boot code during the system manufacturing phase and they may
4655 be also updated during the system lifecycle. These logical units can be read to verify their content.
4656 Therefore the following operations are permitted on the Boot logical units:
4657 1. boot code write – for boot code upload/update
4658 2. boot code read – to verify the content programmed
4659 3. boot code removal – to remove the content of the Boot logical unit
4660 These operations can be executed regardless the bBootEnable field value in the Device Descriptor.
4661
4662 13.1.6 Configurability
4663 The boot process is configurable through several parameters in the Configuration Descriptor (see
4664 14.1.6.3) to adapt it to different usage models and system features.
4665 The following parameters refer to boot capabilities.
4666  Device parameters:
4667 - bBootEnable (Boot Enable)
4668 - bDescrAccessEn (Descriptor Access Enable)
4669 - bInitPowerMode (Initial Power Mode)
4670 - bInitActiveICCLevel (Initial Active ICC Level)
4671  Logical unit parameters for Boot LU A and Boot LU B:
4672 - bLUEnable (Logical Unit Enable)
4673 - bBootLunID (Boot LUN ID)
4674 - bLUWriteProtect (Logical Unit Write Protect)
4675 - bMemoryType (Memory Type)
4676 - dNumAllocUnits (Number of Allocation Units)
4677 - bDataReliability (Data Reliability)
4678 - bLogicalBlockSize (Logical Block Size)
4679 - bProvisioningType (Provisioning Type)
4680 NOTE These parameters are non volatile and are characterized by different levels of changeability. They are one
4681 time writeable and may be programmed during the system manufacturing phase.
4682 In addition to the parameters mentioned, the following attributes are relevant for device initialization and
4683 boot
4684  bBootLunEn (Boot LUN Enable)
4685  bRefClkFreq (Reference Clock Frequency value)
Page 269
4686 13.1.7 Security

4687 13.1.7.1 Boot Area Protection
4688 Boot areas might be protected in order to avoid boot code alteration by a third party: the write protection
4689 mechanism for the boot logical units can be defined configuring the corresponding bLUWriteProtect
4690 parameter of the Unit Descriptor.
4691 In particular, the boot logical units may be permanently write protected or power-on write protected. In
4692 case of power-on write protection, the boot logical units can be written only when the fPowerOnWPEn
4693 flag is equal to zero.
4694
4695 13.2 Logical Unit Management
4696 13.2.1 Introduction
4697 The functionality aims to provide a mechanism to let an external application define and use a virtual
4698 memory organization which could easily fit different usage models in a versatile way.
4699 Besides segmenting the available addressable space, the mechanism introduces the possibility of
4700 differentiating each logical unit through dedicated functionalities and features.
4701 This section describes the procedure to configure the UFS device in terms of: number of logical units,
4702 logical unit size, logical unit memory type, etc. Security features can be configured as described in clause
4703 12 “UFS Security”.
4704 An UFS device can be organized in different logical units. Each one represents an autonomous computing
4705 entity with independent logical address ranges and singularly accessible.
4706 Moreover, each logical unit can be defined for a specified use and with peculiar attributes (i.e., memory
4707 type) in order to be adapted to different UFS host usage models and operating systems requirements.
4708 13.2.2 Logical Unit features
4709 UFS device address space is organized in several memory areas configurable by the user. In particular,
4710 such memory areas are denoted as logical units and characterized by the fact that they have independent
4711 logical addressable spaces starting from the logical address zero.
4712 In addition to the logical units, the UFS device supports the following well known logical units for
4713 specific purposes: UFS Device, REPORT LUNS, Boot and RPMB. Logical units are addressed by the
4714 LUN (logical unit number), while well known logical unit are addressed by the W-LUN (well known
4715 logical unit number).
4716
Page 270
4717 13.2.2 Logical Unit features (cont’d)
Logical Address zero

LUN = 0h Logical unit 0 Boot LU A LU size
Boot LU B
LUN = 1h Logical unit 1 Active LU for boot
LU size
LUN = 3h Logical unit 3 LU size

RPMB well known
W-LUN = 44h LU size
logical unit
4718
4719 Figure 13.4 — Example of UFS Device Memory Organization
4720 NOTE 1 The figure above shows an example of device configuration in which LU 0 and LU 1 are used as boot
4721 logical units, and the logical units 3, 4 and 7 for code and data storage. LU 1 is the boot active logical unit and it
4722 may be accessed in read using the W-LUN = 30h (LUN field in UPIU = B0h).
4723 Each logical unit will have a physical implementation on the non-volatile storage media.
4724 In particular, the UFS device shall support:
4725  Up to eight logical units (LUN = 0, …, 7).
4726  Each of them configurable as boot logical units with a maximum of two.
4727  One RPMB well known logical unit (W-LUN = 44h, LUN field in UPIU = C4h)
4728 Two logical units can be configured as boot logical unit, with only one of them active and readable
4729 through the Boot well known logical unit (W-LUN = 30h) for the execution of the system boot (see 13.1
4730 “UFS Boot”). The RPMB well known logical unit is accessed by authenticated operations by a well
4731 defined security algorithm (see 12.4 “RPMB”). The other logical units will be used to fulfill other use
4732 cases.
4733
Page 271
4734 13.2.2 Logical Unit features (cont’d)

4735 Common features of each logical unit are:
4736  independent logical addressable spaces (starting from logical address zero up to the logical unit
4737 size),
4738  Configurable logical unit size.
4739 The size of each logical unit is determined by the number of allocation block assigned to it:
4740 dNumAllocUnits parameter value of the Configuration Descriptor. The dNumAllocUnits is expressed in
4741 terms of allocation unit size.
4742 Moreover each logical unit is characterized by the memory type parameter which can be configured
4743 during the system integration phase. Examples of memory types to differentiate logical unit properties are
4744 the following ones:
4745  Default type – regular memory characteristic
4746  System Code type – a logical unit that is rarely updated (e.g., system files or binary code
4747 executable files or the host operating system image and other system data structures)
4748  Non-Persistent type – a logical unit that is used for temporary information (e.g., swap file extend
4749 the host virtual memory space)
4750  Enhanced Memory type – vendor specific attribute
4751 The definition of the Enhanced Memory type is left open in order to accomplish different needs and
4752 vendor specific implementations.
4753 Mechanisms of write protection can be configured for each logical unit. Write protection feature types
4754 are:
4755  Permanent write protection (permanent read only)
4756  Power on write protection (write protection can be cleared with a power cycle or a hardware reset
4757 event)
4758 Write protection is not available in the RPMB well known logical unit.
4759
4760
Page 272
4761 13.2.3 Logical Unit Configuration

4762 The user shall configure the logical units of the UFS device according to the following rules:
4763  There can be up to eight logical units (LUN = 0, …, 7).
4764  One or two logical units of the eight can be configured as boot logical units.
4765 When an UFS device is shipped only the following well known logical units will be available: UFS
4766 Device, REPORT LUNS and the RPMB. All other logical units shall be configured before they can be
4767 accessed.
4768 NOTE The RPMB well known logical unit will be configured by the device manufacturer before shipping the
4769 device.
4770 The logical unit configuration can be executed only one time, and it is done writing the Configuration
4771 Descriptor. Once the Configuration Descriptor has been written, a power cycle is required before
4772 accessing the logical units. The configuration of each logical unit can be retrieved by reading the
4773 corresponding Unit Descriptor.
4774 It is recommended to execute logical unit configuration during the system manufacturing phase.
4775 Table 13.3 summarizes the configurable parameters per logical unit. See 14.1.6 “Descriptor Page
4776 Definitions” for details about these parameters.
4777
4778 Table 13.3 — Logical unit configurable parameters
Configurable parameters
Logical Unit
Name Description
bLUEnable Logical Unit Enable LU 0, …, LU 7
bBootLunID Boot LUN ID LU 0, …, LU 7
bLUWriteProtect Logical Unit Write Protect LU 0, …, LU 7
bMemoryType Memory Type LU 0, …, LU 7
Number of allocation units assigned to the

logical unit.
dNumAllocUnits The value shall be calculated considering LU 0, …, LU 7
the capacity adjustment factor of the
selected memory type.
bDataReliability Data Reliability LU 0, …, LU 7
bLogicalBlockSize Logical Block Size LU 0, …, LU 7
bProvisioningType Provisioning Type LU 0, …, LU 7

4779
Page 273
4780 13.2.3 Logical Unit Configuration (cont’d)

4781 The minimum addressable block size in any logical unit of an UFS device is 4 KByte (4096 Bytes).
4782 The following Geometry Descriptor parameters shall be considered when configuring the logical units:
4783  qTotalRawDeviceCapacity (total raw device density in unit of 512 Bytes)
4784  dSegmentSize
4785  bAllocationUnitSize (Allocation Unit Size, value expressed in number of segments)
4786  Maximum number of allocation unit for each memory type (dSystemCodeMaxNAllocU,
4787 dNonPersistMaxNAllocU, etc.)
4788  Capacity Adjustment Factor for each memory type (wSystemCodeCapAdjFac,
4789 wNonPersistCapAdjFac, etc.)
4790  bMinAddrBlockSize (minimum value is eight to denote 8 x 512 Byte = 4 KByte)
4791  bOptimalReadBlockSize and bOptimalWriteBlockSize (which shall be equal to or greater than
4792 bMinAddrBlockSize)
4793  bMaxInBufferSize
4794  bMaxOutBufferSize
4795 To enable the access to a logical unit, the user shall configure Unit Descriptor parameters as described in
4796 the following.
4797  bLUEnable
4798 bLUEnable shall be set to 01h to enable the logical unit. If bLUEnable is equal to 00h the logical
4799 unit is disabled and all Unit Descriptor parameters are don’t care.
4800  bMemoryType
4801 bMemoryType shall be set to value corresponding to the desired memory type. The
4802 wSupportedMemoryTypes parameter in the Geometry Descriptor indicates which memory types
4803 are supported by the device.
4804  bLogicalBlockSize
4805 bLogicalBlockSize value shall adhere to the following rules:
4806 o 2bLogicalBlockSize ≥ bMinAddrBlockSize × 512,
4807 o 2bLogicalBlockSize ≤ bMaxInBufferSize × 512,
4808 o 2bLogicalBlockSize ≤ bMaxOutBufferSize × 512.
4809 It is recommended to choose a value for which 2bLogicalBlockSize is equal to bOptimalWriteBlockSize
4810 or bOptimalReadBlockSize to optimize the device performance. Supported bLogicalBlockSize
4811 values are device specific, refer to the vendor datasheet for further information.
4812
Page 274
4813 13.2.3 Logical Unit Configuration (cont’d)

4814  dNumAllocUnits
4815 dNumAllocUnits determines the size of the logical unit. If LUCapacity is the desired logical unit
4816 size expressed in Byte, the dNumAllocUnits value shall be calculated using the following
4817 equation:
( )
4818 where:
4819 o CapacityAdjFactor = Capacity Adjustment Factor of the particular memory type
4820 The Capacity Adjustment Factor value for Normal memory type is one.
4821 The logical unit capacity can be retrieved by either reading the qLogicalBlockCount parameter in
4822 the Unit Descriptor or issuing the READ CAPACITY command.
4823 In particular, the relations between the parameters returned by READ CAPACITY (RETURNED
4824 LOGICAL BLOCK ADDRESS and LOGICAL BLOCK LENGTH IN BYTES), and
4825 bLogicalBlockSize and qLogicalBlockCount parameters in Unit Descriptors are:
4826 o RETURNED LOGICAL BLOCK ADDRESS = qLogicalBlockCount – 1,
4827 o LOGICAL BLOCK LENGTH IN BYTES = 2bLogicalBlockSize
4828  bBootLunID
4829 bBootLunID shall be set as described in the following:
4830 o 00h: if the logical unit is not a boot logical unit,
4831 o 01h: to configure the logical unit as “Boot LU A”,
4832 o 02h: to configure the logical unit as “Boot LU B”,
4833 NOTE The 01h value and 02h value shall be assigned to no more than one logical unit.
4834  bLUWriteProtect
4835 bLUWriteProtect shall be set as described in the following:
4836 o 00h: if the logical unit is not write protected,
4837 o 01h: to configure power on write protection,
4838 o 02h: to configure permanent write protection.
4839  bDataReliability
4840 bDataReliability shall be set to configure the device behavior when a power failure occurs during
4841 a write operation to the logical unit:
4842 o 00h: logical unit is not protected. Logical unit's entire data might be lost as a result of a power
4843 failure during a write operation,
4844 o 01h: logical unit is protected. Logical unit's data is protected against power failure.
4845  bProvisioningType
4846 bProvisioningType shall be set to configure the logical unit provisioning type:
4847 o 00h: to disable thin provisioning,
4848 o 02h: to enable thin provisioning with TPRZ = 0,
4849 o 03h: to enable thin provisioning with TPRZ = 1.
Page 275
4850 13.3 Logical Block Provisioning

4851 Overview
4852 Logical Block Provisioning is the concept that describes the relationship between the logical block
4853 address space and the physical memory resources that supports the logical address space.
4854 Logical units in a UFS device shall be either a Full Provisioned LU or a Thin Provisioned LU.
4855
4856 Full Provisioning
4857 Every LBA in a fully provisioned logical unit is mapped.
4858 A logical unit that is fully provisioned shall provide enough LBA mapping resources to contain all logical
4859 blocks for the logical unit’s capacity as reported by the device server in response to a READ CAPACITY
4860 command.
4861 The device server shall not cause any LBA on a fully provisioned logical unit to become unmapped.
4862 A fully provisioned logical unit does not support logical block provisioning management – i.e., does not
4863 support UNMAP command.
4864
4865 Thin Provisioning
4866 In thin provisioning there is no requirement that the available physical memory resources match the size
4867 of the logical address space.
4868 A thin provisioned logical unit is not required to provide LBA mapping resources sufficient to contain all
4869 logical blocks for the logical unit’s capacity as reported by the device server in response to a READ
4870 CAPACITY command.
4871 In UFS device, a thin provisioned logical unit shall have sufficient physical memory resources for all
4872 addressable logical blocks when the logical unit is configured writing the Configuration Descriptor: the
4873 number of LBAs reported in READ CAPACITY shall not exceed the number of physical memory blocks
4874 available.
4875 Logical address to physical resource allocation is managed by Logical Block Provisioning Management.
4876 Every LBA in a thin provisioned logical unit shall be either mapped or deallocated.
4877 In UFS device, a thin provisioned logical unit shall support the Mapped and Deallocated states in the
4878 Logical Block Provisioning State Machine. An unmapped LBA shall be a deallocated LBA.
4879 UFS device shall support Thin Provisioned logical unit including: Logical Block Provisioning
4880 Management, UNMAP command, erased, discard and purge functionalities as described in clause 12,
4881 UFS Security.
4882
4883
Page 276
4884 13.4 Host Device Interaction

4886 This proposal provides mechanisms for the host and device to communicate about pending operations so
4887 that the performance and/or reliability of the device can be improved.
4888 13.4.2 Applicable Devices
4889 All the features described 13.4 should be implemented on UFS devices. The extent to which the features
4890 are implemented will be up to the device manufacturer. It is expected that poor implementations will
4891 result in lower device performance or reliability and higher max power consumption in the low power
4892 modes.
4893 13.4.3 Command Queue: Inter-LU Priority
4894 The specific details of how commands interact in a queue of a specific logical unit are handled in other
4895 chapters. This section outlines how the queues within a device interact with each other. JESD220B
4896 acknowledges that there may be many different implementations of a UFS controller. For example, it
4897 may be implemented as a single or multithreaded processor. In order to make the UFS spec
4898 implementation agnostic this section outlines a parameter that allow the host to communicate to the
4899 device its priorities so that the device can take this into account when executing commands from the host.
4900 In the implementation case where several queues are serviced from a single execution unit, it is necessary
4901 for the host to either designate all queues as having the same priority or designate a single Queue as
4902 having a higher priority. A parameter value shall be defined to allow the host to designate a queue as
4903 having high or normal priority. In the case where a queue is designated as having a higher priority,
4904 whenever a command enters the queue with the high priority it will be executed as soon as possible
4905 resulting in commands from other queues being stalled.
4906 One example of where a host may want to take advantage of this feature is when the host has allocated
4907 one logical unit to be a code execution unit and another unit to be a mass storage unit. In this example the
4908 execution of code takes priority over mass storage transfers, so the host would set the parameter bit
4909 associated with the code logical unit to be high priority and leave the remaining queues as lower priority.
4910 The logical unit supports two level of queue priorities:
4911 1. High priority – This is used for logical unit with high priority requests. Any commands sent to
4912 this logical unit will have higher priority than commands sent to logical units with lower priority.
4913 For example, when servicing demand-paging applications, read commands would have this
4914 priority.
4915 2. Normal priority – This is used for all regular logical units which do not belong to priority #1
4916 In addition to the execution of commands explicitly issued by the host, the device may execute
4917 background operations for device house-keeping. In general those operations have a much lower priority
4918 than the commands sent by the host and are implemented using a specific method described in 13.4.4
4919 “Background Operations Mode”.
4920
Page 277
4921 13.4.3.1 Implementation

4922 The bHighPriorityLUN parameter in the Device Descriptor shall be set to configure which logical unit
4923 has the command queue with the higher priority.
4924 bHighPriorityLUN shall be set to
4925  7Fh: if all logical units have the same priority,
4926  LUN of the higher priority logical unit.
(1)
Name Description Valid Values Default
bHighPriorityLUN defines the high

0 to 7,
priority logical unit.
bHighPriorityLUN and 7Fh 7Fh
If this parameter value is 7Fh all
logical unit have the same priority.
4927 NOTE 1 The column “Default” defines the parameter value set by the device manufacturer.
4928 13.4.4 Background Operations Mode

4929 13.4.4.1 Introduction
4930 A managed device requires time to execute management tasks. The background operations mode grants
4931 the device time to execute the commands associated with these flash management tasks. Flash
4932 management operations may include, but are not limited to, wear leveling, bad block management, wipe
4933 and garbage collection. The operations completed during the background operations period are
4934 determined by the device manufacturer and are not covered by the UFS spec.
4935 13.4.4.2 Purpose
4936 Performance Improvement
4937 The intent of this mode is to improve a device response to host commands by allowing the device to
4938 postpone device management activities that occur as a result of host initiated operations to periods when
4939 the host is not using the device.
4940 Systems that will use a UFS device tend to have peak periods of activity, in which the best response
4941 possible is needed from the UFS device. These peak periods are followed by idle periods, where the host
4942 can allow the device to do device management operations. Allowing better communication between the
4943 host and the device on when these idle periods will occur allows the UFS device to perform more
4944 optimally in the system.
4945 The device will still be permitted to do device management when the host initiates operations, however
4946 the downside of doing this may be poorer device performance. This mode will just give device
4947 manufacturers the option to delay device management operations to improve performance. It is
4948 recommended that devices postpone as many tasks as possible to take full advantage of the possible
4949 performance improvements associated with this feature.
4950 Host Power Management
4951 This mode will also allow the host to control when the device uses power to perform management
4952 activities. The host will have more knowledge about the power consumed by the system and can make the
4953 appropriate tradeoffs about when to use system power and when to conserve it.
4954 An example of where host control over power consumed by the device could be an advantage would be
4955 the case where the system has very little battery power and the UFS device has a lot of unused memory.
Page 278
4956 13.4.4.2 Purpose (cont’d)

4957 In this case the host may not wish for the device to perform clean up operations but conserve the power
4958 for more critical system functions.
4959 Allowing the host to communicate with the device on when activities can be performed will allow better
4960 system power management, which can be controlled by the host.
4961 13.4.4.3 Background Operations Status
4962 The device signals to the host that the device has a need for background operations using the Exception
4963 Event mechanism, and in particular the URGENT_BKOPS bit in wExceptionEventStatus
4964  ‘0’: No immediate need to execute background operation (corresponds to no operations or non-
4965 critical)
4966  ‘1’: Immediate need to execute background operation (corresponds to performance being
4967 impacted or critical)
4968 When the host detects a request for executing background operations (URGENT_BKOPS set to one) it
4969 may read the bBackgroundOpStatus attribute to find out the need level, as follows:
4970  00h : No operations required
4971  01h : Operations outstanding (non-critical)
4972  02h : Operations outstanding (performance being impacted)
4973  03h : Operations outstanding (critical)
4974 The URGENT_BKOPS bit is set to zero if the bBackgroundOpStatus is set to zero or one;, otherwise it is
4975 set to one.
4976 It is expected that the host will respond as soon as possible when the status changes to service, since if the
4977 background operations are not properly managed, then the device could fail to operate in an optimal way.
4978 In the case where the device status is operations outstanding (critical) this will mean that the device will
4979 only respond to mode sense and mode select commands. The host should put in all possible measures to
4980 ensure the device never reaches this state since it means the device is no longer able to operate.
4981 The point at which the device enters each of these states is up to the manufacturer and is not defined in
4982 this specification.
4983 13.4.4.4 Operation Initiation
4984 There is no explicit command to start the background operations. A mode enable bit is defined that
4985 indicates whether the device is allowed to execute background operations. If the background operations
4986 mode bit is set and the device is in Active power mode or Idle power mode, then the device is allowed to
4987 execute any internal operations required.
4988 When the device receives a COMMAND UPIU which requires a data transfer, the device shall start the
4989 data transfer and send a DATA IN UPIU or a RTT UPIU within the time declared in
4990 bBackgroundOpsTermLat. The host can minimize the device response time by disabling background
4991 operations mode during critical performance times.
4992 In the case where the background operations status is “operations outstanding (critical)”, the
4993 aforementioned latency limit does not apply.
4994
Page 279
4995 13.4.4.5 Power Failure

4996 It is the device’s responsibility to ensure that the data in the device is not corrupted if a power failure
4997 occurs during a background operation.
4999 Background Operations Enable
5000 fBackgroundOpsEn is the Flag to be used to enable or disable the execution of background operations.
5001 This Flag is defined as follows:
5002  0 = Device is not permitted to run background operations
5003  1 = Device is permitted to run background operations.
5004 The default value of this Flag is one: background operations permitted. The device shall terminate
5005 ongoing background operations when this Flag is cleared by the host. For more details see Table 14.19
5006 “Flags”.
5007 Background Operations Status
5008 bBackgroundOpStatus is an attribute defined as follows:
5009  00h = not required
5010  01h = required, not critical
5011  02h = required, performance impact
5012  03h = critical.
5013 For more details see 14.3, “Attributes”.
5014 Background Operations Termination Latency
5015 bBackgroundOpsTermLat defines the maximum latency for starting data transmission when background
5016 operations are ongoing. The termination latency limit applies to two cases:
5017  When the device receives a COMMAND UPIU with a transfer request. The device shall start the
5018 data transfer and send a DATA IN UPIU or a RTT UPIU within the latency limit.
5019  When the device receives QUERY REQUEST UPIU clearing fBackgroundOpsEn Flag. The
5020 device is expected to terminate background operations within the latency limit.
5021 The termination limit does not apply in the case where the background operations status is “operations
5022 outstanding (critical)”.
5023 bBackgroundOpsTermLat is a parameter of the Device Descriptor and its granularity is 10msec. It is
5024 expected that transitions between link states (e.g., HIBERNATE to ACTIVE) or temporary congestion on
5025 the link occur in shorter timescales and are therefore negligible in comparison to the background
5026 operations timescale.
5027 13.4.5 Power Off Notification
5028 A UFS host will notify the device when it is going to power the device off by requesting the device to
5029 move to UFS-PowerDown power mode. This will give the device time to cleanly complete any ongoing
5030 operations. The device will respond to the host when it is ready for power off, meaning that the device
5031 entered the UFS-PowerDown power mode. Host can then power off the device without the risk of data
5032 loss.
5033
Page 280
5034 13.4.6 Dynamic Device Capacity

5035 Common storage devices assume a fixed capacity. This presents a problem as the device ages, and get
5036 closer to its end of life. When some blocks of the device become too old to be used reliably, spare blocks
5037 are reallocated to replace them. A device contains some spare blocks for this purpose, as well as for some
5038 housekeeping operations. However, when all spare block s are consumed, the device can no longer meet
5039 its fixed capacity definition and it stops being functional (some become read‐only, some stop responding
5040 completely).
5041 A simple solution to enable the host to continue operation at the end of the device lifetime, would be to
5042 allow the capacity to be dynamic. If the device is allowed to reduce its reported capacity, it can reallocate
5043 blocks that were used to store data as new spare blocks to compensate for aging. To support this, the
5044 device needs to report to the host how much more spare blocks it needs for each logical unit, and then the
5045 host needs to relinquish some used blocks to let the device reallocate them as spares.
5047 13.4.6.1.1 Initial Device Requirements
5048  Only logical units that support thin provisioning and logical block provisioning management
5049 functions can be involved in the dynamic device capacity process. The host can discover if thin
5050 provisioning is enabled and if a logical unit supports logical block provisioning management
5051 functions at UTP level, reading the bProvisioningType parameter in the Unit Descriptor of each
5052 logical unit, or at SCSI level through the TPE bit in the READ CAPACITY (16) parameter data.
5053 o bProvisioningType shall be either 02h or 03h.
5054 o TPE bit shall be set to one.
5055  The Unit Descriptor of each logical unit includes the following two parameters:
5056 qLogicalBlockCount and qPhyMemResourceCount.
5057 o The qLogicalBlockCount is equal to the total number of addressable logical blocks in the
5058 logical unit, expressed in 2bLogicalBlockSize unit. Its value is established when the logical unit is
5059 configured and never changes during the device life time. In particular, the
5060 qLogicalBlockCount value shall be equal to RETURNED LOGICAL BLOCK ADDRESS +
5061 1 (RETURNED LOGICAL BLOCK ADDRESS is a field included in the Read Capacity
5062 Parameter Data and corresponds to the last addressable block on medium under control of
5063 logical unit).
5064 o The qPhyMemResourceCount is equal to the total physical memory resource available in the
5065 logical unit, expressed in 2bLogicalBlockSize unit. Its value decreases with the execution of
5066 dynamic capacity process.
5067  UFS requires that there shall be sufficient resource in the physical memory resource pool to
5068 support the logical addressable memory space reported in READ CAPACITY when the device is
5069 first configured. Therefore, qPhyMemResourceCount shall be equal to qLogicalBlockCount in
5070 the Unit Descriptor initially.
5071  Dynamic device capacity feature does not involve the RPMB well known logical unit, write
5072 protected logical units, or logical units configured as boot logical unit (Boot LUN ID = 01h or
5073 02h).
5074
Page 281
5075 13.4.6.1.2 Dynamic Capacity Procedural Flow

5076 1. When the physical memory resources necessary for proper operation in a logical unit has been drawn
5077 down the device may request to the host to remove some resources from the physical memory
5078 resource pool serving the logical address space of the logical units. This is achieved setting to one the
5079 DYNAMIC CAPACITY EVENT OCCURRED bit in the wExceptionEventStatus attribute, which
5080 will force to one the EVENT ALERT bit of Device Information field included in the RESPONSE
5081 UPIU.
5082 2. Device shall indicate the amount of physical memory to be removed from the resource pool in
5083 dDynCapNeeded attribute. Each element of the dDynCapNeeded[LUN] shall be equal to the amount
5084 of bytes to be removed divided by the optimal write block size (bOptimalWriteBlockSize is a
5085 parameter in the Geometry Descriptor). Therefore, the host can calculate the amount of physical
5086 memory to be removed from the resource pool for each logical unit multiplying the
5087 dDynCapNeeded[LUN] attribute by bOptimalWriteBlockSize parameter. UFS device shall not
5088 request to remove physical memory from the resource pool of logical units which are write protected
5089 or configured as boot logical unit (dDynCapNeeded[LUN] shall be zero).
5090 3. The host ensures that all outstanding tasks in the device queues have been completed or aborted.
5091 4. The host ensures that the amount of LBAs in the deallocated state is equal or greater than the amount
5092 of requested physical memory resource for each logical unit. If necessary the host sends UNMAP
5093 commands to deallocate additional LBA.
5094 a. The range(s) of LBA in the deallocate state shall be aligned to a bOptimalWriteBlockSize
5095 boundary, and their size shall be an integer multiple of bOptimalWriteBlockSize .
5096 b. The LBA range(s) shall be equal or greater than the memory resource amount that has been
5097 requested by the device for each logical unit.
5098 c. The LBA range(s) does not need to be at the end of the logical address space.
5099 5. The host sets fPhyResourceRemoval flag to one and trigger an EndPointReset or a device hardware
5100 reset to initiate the dynamic capacity operation.
5101 6. The host may either execute the complete boot process as described in 13.1 “UFS Boot” or may skip
5102 reading the boot logical unit and set fDeviceInit flag to one to start the device initialization. During
5103 this phase the device will execute the dynamic capacity operation. The host waits until the device
5104 clears fDeviceInit flag. The device initialization may take a time longer than normal initialization due
5105 to internal processes necessary to re-arrange physical memory resource. If a power loss occurs, the
5106 dynamic capacity operation will proceed at the next power up during the device initialization.
5107 7. When the dynamic capacity operation is completed, the device will clear fDeviceInit flag and the
5108 fPhyResourceRemoval flag. If the operation is completed successfully, the DYNAMIC CAPACITY
5109 EVENT OCCURRED bit is cleared too, therefore the EVENT ALERT bit in Device Information will
5110 return to zero, if no other exception events are active. The qPhyMemResourceCount parameter in the
5111 Unit Descriptors is updated with a new value reflecting the amount of physical memory resource
5112 remaining in the resource pool.
5113 NOTE The qLogicalBlockCount parameter in the Unit Descriptors and the RETURNED LOGICAL BLOCK
5114 ADDRESS parameter in Read Capacity Parameter Data will stay the same as initially configured. Therefore,
5115 the updated qPhyMemResourceCount value will be less than those two parameters after dynamic capacity
5116 operation.
5117
Page 282
5118 13.4.6.1.2 Dynamic Capacity Procedural Flow (cont’d)

5119 8. If the dynamic capacity operation does not succeed, for example because LBA range(s) does not meet
5120 one or more of the requirements described in point 4, the DYNAMIC CAPACITY EVENT
5121 OCCURRED bit shall remain set to one. Therefore, the EVENT ALERT in the Device Information
5122 field of the RESPONSE UPIU will remain set to one to notify the host that further dynamic capacity
5123 operation is needed.
5124 NOTE The dDynCapNeeded[LUN] attribute value may have been updated.
5125 9. To account for the reduction of the physical memory resource pool after dynamic capacity operation,
5126 the host maintains a range(s) of LBA’s in deallocated state that are aligned in address and size to
5127 integer multiples of bOptimalWriteBlockSize, with the total equal to or greater than
5128 qLogicalBlockCount minus qPhyMemResourceCount. Otherwise, a write error will result when the
5129 host attempts to write (map) more LBA’s than the available physical memory resource.
5130 NOTE The host may change the LBA range(s) that are in deallocate state during the use of the device.
5131 13.4.6.1.3 Dynamic Device Capacity Notification
5132 The dynamic device capacity is one of the exception events that may set the EVENT ALERT bit of the
5133 Device Information field included in the RESPONSE UPIU.
5134 To enable the setting of this bit, the DYNAMIC CAPACITY EVENT ENABLE bit in the
5135 wExceptionEventControl attribute shall be set to one.
5136 When the host detects that the EVENT ALERT bit is set to one, it shall read the wExceptionEventStatus
5137 attribute to discover if the source this event is a request for reducing the device capacity. In particular, if
5138 DYNAMIC CAPACITY EVENT OCCURRED bit is set to one, the host should process the request as
5139 described in the specification.
5140 The DYNAMIC CAPACITY EVENT ENABLE bit shall be set to zero if the host is not capable or does
5141 not intend to use the dynamic device capacity feature. Otherwise, a dynamic capacity request event will
5142 set the EVENT ALERT bit to one, masking out notification of other exception events.
5143 13.4.6.1.4 Error handling
5144  Success/failure to unmap (release) LBA’s is as defined in UNMAP command.
5145  If the host ignores the dynamic device capacity notification and continues to write to the device
5146 without unmapping LBA’s to free up physical memory, the device may become non-writeable
5147 over time and cause a WRITE command to fail. In which case, the device server shall return the
5148 following error condition in response to the WRITE command.
5149 o The device server shall terminate the command requesting the operation with CHECK
5150 CONDITION status with the sense key set to DATA PROTECT and the additional sense
5151 code set to SPACE ALLOCATION FAILED WRITE PROTECT.
5152  When the qPhyMemResourceCount is less than qLogicalBlockCount in Unit Descriptors, it
5153 indicates that the physical memory resource pool is smaller than the logical addressable memory
5154 space (LBA’s) in the logical unit. It is the host’s responsibility to keep track of the amount of
5155 physical memory available. If the host attempts to write more data than the available physical
5156 memory resources and the device is unable to complete the write operation successfully, the
5157 device shall return the following error condition.
5158 o The device server shall terminate the command requesting the operation with CHECK
5159 CONDITION status with the sense key set to DATA PROTECT and the additional sense
5160 code set to SPACE ALLOCATION FAILED WRITE PROTECT.
Page 283
5161 13.4.6.1.5 Physical Memory Resource State Machine

5162 Figure 13.5 shows the state machine for the physical memory resources. The presence of “Removed from
5163 the Resource Pool” state in addition to the “Mapped” state and “Deallocated” state, which are defined in
5164 logical block provisioning state machine too.
Mapped UNMAP
(2)
(1)
Removed from
Deallocated
resource pool WRITE
(3)
UFS definition Initial state for UFS
outside SCSI
Device initialization with
fPhyResourceRemoval = ‘1’
5165
5166 Figure 13.5 — Physical Memory Resource State Machine
5167 1. Write operation: physical memory resource from the resource pool is mapped to LBA containing
5168 valid data.
5169 2. UNMAP operation for erase/discard:
5170 a. Physical memory resource is unmapped (deallocated) from LBA and returned to the resource
5171 pool.
5172 b. Residual data in unmapped physical memory resource are not valid.
5173 3. Device re-initialization with fPhyResourceRemoval flag previously set to one causes some
5174 physical memory resources to be removed from the resource pool servicing the logical address
5175 space. After conversion the qPhyMemResourceCount is updated by UFS device to indicate the
5176 amount of physical memory resource remaining in the resource pool of each logical unit.
5177
Page 284
5178 13.4.7 Data Reliability

5179 13.4.7.1 Description
5180 The UFS host has the ability to define the level of data reliability during normal operation and power
5181 failure per logical unit.
5182 There are two components to the data reliability that are defined for UFS. The first component deals with
5183 the data currently being written and the second deals with the data that has previously been stored in the
5184 medium.
5185 The first component, also known as Reliable Write, means that if the device losses power during a write
5186 operation to the medium (when executing a SCSI write command, a host-initiated flush of data to the
5187 medium, etc.), the data in the range affected by the operation will be either the old data or the new written
5188 data when the device recovers from power failure.
5189 Keeping either the old or new data is important for the file system to recover after power loss. The file
5190 system may keep its structures segmented and signed with CRC or equivalent mechanism. The device
5191 insures that a large enough granularity of data is authentic either with an old or new copy, to make sure
5192 the file system can validate or invalidate these segments.
5193 The resolution for the old and new data shall be aligned to the logical block size. The figure below shows
5194 some of the possible scenarios that the host will see when it recovers from power failure during a 32
5195 Kbyte write operation in a logical unit with 4 Kbyte logical block size.
5196 For RPMB well known logical unit, the data reliability granularity shall be equal to
5197 bRPMB_ReadWriteSize × 256 bytes.
4 Kbyte
NEW OLD NEW NEW NEW NEW OLD OLD
NEW NEW NEW NEW OLD OLD OLD OLD
32 Kbyte
5198
5199 Figure 13.6 — Example of data status after a power failure during reliable write operation
5200 The second component, also known as Data Reliability, allows the host to define the level of protection
5201 that must be applied to existing data on the device. In some technologies that will be used to implement
5202 UFS devices, the device has the option to potentially sacrifice some of the existing data on a device
5203 during a power failure in order to provide better write performance. Depending on the application for the
5204 end device the host can select per logical unit whether the data in that logical unit shall be protected
5205 during power failure, which may have a performance impact, or to select device performance with the risk
5206 of losing data during a power failure.
5207 Data Reliability feature for each logical unit can be set when the device is configured during system
5208 integration.
5209 In particular, if Data Reliability is enabled, the logical unit will execute Reliable Write operation and the
5210 data already stored in the medium will not be corrupted by a power failure occurred during the execution
5211 of a write operation to the medium.
5212 The data reliability feature will be configurable only for logical units and not for well known logical units.
5213 The RPMB well known logical unit will automatically select data reliability.
Page 285

5215 bDataReliability parameter in the Unit Descriptor shall be used by the host to configure the logical unit
5216 data reliability.
5217 bDataReliability values are defined as in the following:
5218 00h: Data reliability disabled
5219 Corruption of the existing data in the medium of the specific logical unit may occur if a power loss
5220 happens during device activity like writing of data to medium.
5221 01h: Data reliability enabled
5222 The existing data stored in the medium of the specific logical unit shall not be corrupted if a power
5223 loss occurs, and the memory range that was accessed by the interrupted write command shall
5224 contain the old data or new data (or a mixture of old and new data as explained in 13.4.7.1) once
5225 power is restored.
5226 Table 13.4 — Parameter for controlling logical unit data reliability
Parameter Name Description
bDataReliability defines the device behavior when a power failure occurs when
writing data to the medium
bDataReliability 00h: Data reliability disabled
01h: Data reliability enabled
Others: Reserved
5227 13.4.8 Real-Time Clock Information

5228 Providing Real Time Clock (RTC) information to a storage device could be useful for the device internal
5229 maintenance operations (execution of RTC internal operations is not affected by fBackgroundOpsEn flag
5230 value).
5231 Host may provide either absolute time if available, or relative time information. This feature provides a
5232 mechanism for the host to update either absolute or relative time.
5233 The host sends RTC information when a wPeriodicRTCUpdate has passed since the last RTC information
5234 update. In case the device is not powered up or asleep when the period has expired, the host wakes it up
5235 and update RTC information.
5236 NOTE When device is configured with wPeriodicRTCUpdate as ‘undefined’ (see Device Descriptor) a
5237 wPeriodicRTCUpdate could not expire and the host may update RTC information considering vendor
5238 recommendations.
5239 It is recommended that host send RTC information when the device enters an Active State.
5240 Updating RTC information is done by writing to dSecondsPassed attribute.
5241 While the device is busy handling an RTC update event and the related background operation, the device
5242 may keep the fBusyRTC flag is set to ‘1’.
5243 The device may perform operations in the background as a result of receiving RTC update. In order to
5244 allow optimized efficiency of these background operations, it is recommended that the host refrains from
5245 sending commands, other than Query Request to the device, and keep the device powered and in Active
5246 Mode for as long as fBusyRTC flag is set to ‘1’. The device may consume active power during that time.
5247 Therefore, it would be advisable to update RTC in times where the system is usually idle and has no
5248 specific power limitations, e.g., at night time when battery is being charged.
Page 286
5249 13.4.9 Context Management

5250 To better differentiate between large sequential operations and small random operations and to improve
5251 multitasking support, contexts can be associated with groups of read or write commands. Associating a
5252 group of commands with a shared context allows the device to optimize data handling.
5253 A context can be seen as an active session, configured for a specific read/write pattern (e.g., sequential in
5254 some granularity). Multiple read or write commands are associated with this context to create some
5255 logical association between them, to allow device performance optimization. For example, a large
5256 sequential write pattern may have better performance by allowing the device to improve internal locality
5257 and reduce some overheads (e.g., if some large unit of data is allowed to be affected by a power failure as
5258 a whole while it is being written to, all of the commands that fill this unit can work faster because they
5259 can reduce the overhead usually required to protect each write individually in case of a power failure).
5260 Furthermore, handling of multiple concurrent contexts allows the device to better recognize each of the
5261 write patterns without getting confused when they are all mixed together.
5262 The maximum number of contexts the device can support is reported in the bMaxContexIDNumber field
5263 of the Geometry Descriptor. When the host configures the device, it divides this number across the
5264 created LUs and writes the number of contexts to be supported in each LU to wContextCapabilities field
5265 in the Configuration Descriptor.
5266 To use a context, an available context ID shall be picked. Then, it shall be initialized by writing the
5267 configuration attribute of relevant LU (wContextConf). Then, data can be read/written associated to the
5268 context by specifying the Context ID in GROUP NUMBER field of the CDB of the read/write command.
5269 When the context is no longer used, the configuration attribute (wContextConf) should be written as all
5270 ‘00’ by the host to close the context. A context shall be closed prior to re-configuring it for another
5271 configuration/use.
5272 No ContextID shall be open after power cycle.
5273
5274
Page 287
5275 13.4.9.1 Context configuration

5276 Before any context can be used it shall be configured.
5277 Configuration is done by setting the context configuration attribute of relevant LU (setting wContextConf
5278 with INDEX equal to LUN and SELECTOR equal to ContextID, SELECTOR ‘0’ is reserved.). Then, all
5279 read commands or write commands that are associated with this ContextID shall be sent using GROUP
5280 NUMBER set to ContextID.
5281 When the context is no longer needed, it should be closed by writing a zero byte to the configuration
5282 attribute.
5283 To configure a specific ContextID for a specific LU, the following fields shall be written to the context
5284 configuration attribute of the specific context needed:
5285  Activation and direction mode (read-only, write-only or read/write)
5286 The direction indicates if all following accesses to this context would be either read-only, write-
5287 only or both read/write. Writing a non-zero direction to this field is the ‘activation code’ for the
5288 context. A zero in this field means a closed context which can no longer be addressed by its ID
5289 until re-configured.
5290  Large Unit context flag
5291 This indicates if the context is following Large Unit rules or not
5292 o If Large Unit context flag is set, then the Large Unit multiplier is used to specify the larger
5293 unit size.
5294  Reliability mode
5295 Controls how data written to a context should respond to interruptions.
5296
5297 13.4.9.2 Activation and direction mode
5298 A non-zero context can be configured as a read-only context, a write-only context or a read/write context.
5299 Any read command associated with any context to an address that is part of an active write-only context is
5300 not allowed, and may either fail the command or return dummy data.
5301 Any write command associated with any context to an address that is part of an active read-only context is
5302 not allowed, and may either fail the command, ignore the data written or cause unexpected data to return
5303 in the read commands.
5304 A context that is configured as read/write context may be read while written, as long as the writing
5305 follows the context rules.
5306 NOTE read/write context may have reduced performance compared to read-only or write-only contexts.
5307
Page 288
5308 13.4.9.3 Large-Unit mode

5309 The Large Unit is the smallest unit that can be used for large sequential read/write operations, in order to
5310 reduce internal overheads and improve performance.
5311 Accessing a Large Unit (both read and write) shall:
5312  Use a ContextID configured to operate in Large Units
5313  Always access a full Large Unit, in order and from beginning to end
5314  Multiple read/write commands may be used to read or write the Large Unit and they may be
5315 interleaved with other accesses and commands, as long as the specific Large Unit is being
5316 accessed with its own separate context ID
5317  A Large Unit that is being written to shall not be modified outside the scope of the context
5318 (e.g., no other writes from other contexts to the address range of the Large Unit shall be used,
5319 no erases/trims to that range, etc.)
5320  Different Large Units belonging to the same context may be located in non consecutive
5321 addresses on the media, as long as alignment is kept (a Large Unit shall be accessed in order
5322 from beginning to end, but only within the range of the specific Large Unit – the next Large
5323 Unit can be non‐consecutive and even in a lower address)
5324  When writing a Large Unit context, data shall always be aligned and in multiples of
5325 bOptimalWriteBlockSize
5326 When writing a Large Unit context, last Large Unit before closing the context may be partially written, as
5327 long as it is written from the beginning, in order and up to a specific point where it is closed. The rest of
5328 the Large Unit may be padded by the device to the end of the Large Unit with random data.
5329
Page 289
5330 13.4.9.4 Reliability mode

5331 In case a write command to a context-ID is interrupted, the device behaves as if all the writes to the
5332 context from its configuration were written in one large write command.
5333 In case of a power failure or software reset before closing an active context – even if not in the middle of
5334 a write command to the specific context (even if not in the middle of any command) – is considered as if
5335 the event occurred during writing the entire context.
5336 A context behavior is determined as part of its configuration and is applied to all writes to this context
5337 until it is closed. Interruption during any of the writes may cause some of the data not to be fully
5338 programmed on the device. Still no partial Logical Block (of bLogicalBlockSize size) shall exist – any
5339 Logical Block written as part of the context shall contain either the new data written or its old data before
5340 the context was configured. The scope of data that may be affected by the interruption depends on the
5341 mode configured:
5342  For non‐Large Unit contexts:
5343 o MODE0 – Normal mode – Any data written to the context from the time it was configured
5344 may be affected
5345 o MODE1 – Non‐Large Unit, reliable mode – Only data written by a specifically interrupted
5346 write command may be affected. Any previously completed write to the context shall not be
5347 changed because of any interruption.
5348  For Large Unit contexts:
5349
5350 NOTE In the cases below, the unit N refers to the current Large Unit which is being written to when
5351 interruption occurs, unit N‐1 refers to the last Large Unit of the context that was written completely before
5352 the current one and unit N‐2 and earlier are Large Units that were completed before the N‐1 unit.
5353 o MODE0 – Normal mode – Any unit may be affected: Any data written to the context from
5354 the time it was configured may be affected.
5355 o MODE1 – Large Unit, unit‐by‐unit mode – Unit N may be affected, units N‐1 and earlier are
5356 not: Any data written to a Large Unit context may affect the entire specific Large Unit
5357 accessed. Any previously completed Large Units in the context shall not be changed because
5358 of any interruption.
5359 o MODE2 – Large Unit, one‐unit‐tail mode – Unit N and N‐1 may be affected, units N‐2 and
5360 earlier are not: Any data written to a Large Unit context may affect the entire specific Large
5361 Unit accessed and the entire completed Large Unit that was accessed before the current one.
5362 Any other completed Large Units in the context shall not be changed because of any
5363 interruption.
5364 In case the host sends a Task Management Request to abort a write command to a non-zero context or the
5365 write command fails with an error, the write may still be interrupted like any context-less write. In case
5366 these scenarios are interrupting a write to a Large Unit context, the device shall always stop writing on a
5367 bOptimalWriteBlockSize boundary (and report dCorrPrgBlkNum accordingly), so host may later
5368 continue the stopped write from an address that is aligned to bOptimalWriteBlockSize as required for
5369 Large Unit contexts.
5370
Page 290
5371 13.4.9.5 Large-Unit Multiplier

5372 In order to allow increased performance by parallelism, the device may allow reading or writing in
5373 multiples of the Large Unit granularity.
5374 The device reports through a Unit Descriptor parameter, wContextCapabilities, the maximum multiplier
5375 that is supported for that LU.
5376 The Large Unit size is configured setting the Large Unit Multiplier as defined in the following:
5377 Large Unit size = 1Mbyte × (bLargeUnitGranularity_M1+1) × Large Unit Multiplier.
5378 For example, if the Large Unit granularity is 1MB, reading data from a Large Unit context configured
5379 with a multiplier of 2 shall be done in full units of 2MB and aligned to 2MB. Inside each such unit, same
5380 rules apply as if it was a normal Large Unit context with a Large Unit size of 2MB.
5381
5382 13.4.10 System Data Tag Mechanism
5383 The System Data Tag mechanism enables the host to notify the device when System Data is sent for
5384 storage (for instance file system metadata, operating system data, time stamps, configuration parameters,
5385 etc.). This notification (using GROUP NUMBER field in the CDB) would guide the device to handle the
5386 System Data optimally. By matching storage characteristics to the System Data characteristics the device
5387 could improve access rate of read and update operations and offer a more reliable and robust storage
5388 characteristics.
5389 A UFS device has a limited amount of System Data area, a storage area with special characteristics which
5390 are tailored to the characteristics and needs of system data. When receiving System Data Tag notification
5391 along with the write command, the device will store the system data in the System Data area. In case the
5392 capacity available for storing System Data is completely consumed, the device will store the System Data
5393 in regular storage. Additionally, if the SYSPOOL EVENT ENABLE bit is equal to one, the SYSPOOL
5394 EVENT OCCURRED bit shall be set to one, which will force to one the EVENT ALERT bit of Device
5395 Information field present in the RESPONSE UPIU. The SYSPOOL EVENT ENABLE bit is included in
5396 the wExceptionEventControl attribute, while the SYSPOOL EVENT OCCURRED bit included in
5397 wExceptionEventStatus attribute.
5398 The host may free up System Data area by unmapping LBAs that were previously written with system
5399 data tag characteristics.
5400 The device handles the System Data Tag mechanism in units of system data, the size of system data unit
5401 is device specific and can be retrieved reading the bSysDataTagUnitSize parameter in the Geometry
5402 Descriptor.
5403 The total available capacity for System Data equals to bSysDataTagUnitSize times bSysDataTagResSize
5404 (See bSysDataTagResSize in Geometry descriptor).
5405 When a host tags system data during a write operation, an entire storage area of bSysDataTagUnitSize
5406 size is handled by the device as system data area even if the size of the data being written is less than
5407 bSysDataTagUnitSize. In addition, any command (Write, Unmap, etc…) which updates a system data
5408 unit with data not tagged as System Data will change the entire system data unit storage characteristics to
5409 regular data. Therefore, it is recommended to handle system data in full units of bSysDataTagUnitSize
5410 size.
5411 System Data areas are available only in Normal memory type logical units.
Page 291
5412 13.4.11 Exception Events Mechanism

5413 The Exception Events Mechanism is used by the device to report occurrence of certain events to the host.
5414 It consists of three components EVENT_ALERT bit, the wExceptionEventStatus attribute and
5415 wExceptionEventControl attribute:
5416  A bit in wExceptionEventStatus attribute is assigned to each exception event. The device shall set
5417 the wExceptionEventStatus bits to one when the corresponding exception events are active,
5418 otherwise they shall be set to zero.
5419  A bit in wExceptionEventControl attribute is assigned to each exception event.
5420 EVENT_ALERT bit shall be set if there is at least one wExceptionEventStatus bit and and
5421 wExceptionEventControl bit pair set to one.
5422 The setting of an wExceptionEventStatus bit to one will not force the EVENT_ALERT bit to one
5423 if the corresponding bit in the wExceptionEventControl is zero.
5424  The EVENT_ALERT is a bit in the Device Information field of the Response UPIU which is the
5425 logical OR of all bits in the wExceptionEventStatus masked by the bits of the
5426 wExceptionEventControl. The EVENT_ALERT bit is set to one when at least one bit in the
5427 wExceptionEventStatus is set and the corresponding wExceptionEventControl bit is one. The
5428 EVENT_ALERT is set to zero if all exception events that are enabled in the
5429 wExceptionEventControl are not active.
5430 There are three defined exception events: dynamic device capacity, system pool exhausted and
5431 background operation. The bits in the wExceptionEventStatus associated with those exception
5432 events are described in the following:
5433  DYNCAP_NEEDED – the device requests a Dynamic Capacity operation (see 13.4.6 “Dynamic
5434 Device Capacity”). This bit is cleared once a Dynamic Capacity operation has completed
5435 successfully, releasing the entire capacity that the device had requested to release.
5436  SYSPOOL_EXHAUSTED – the device ran out of resources to treat further host data as System
5437 Data (see 13.4.10 “System Data Tag MechanismDynamic Device Capacity”). This bit is cleared
5438 once the host has turned enough memory areas that were previously handled as System data
5439 areas, to non-system data areas.
5440  URGENT_BKOPS – the device requests host attention for the level of need in Background
5441 Operations (see 13.4.4 “Background Operations Mode”). This bit is cleared once
5442 bBackgroundOpStatus returns to 00h or 01h.
5443 The device will only indicate events, in the Device Information field of the RESPONSE UPIU, for that
5444 were enabled by the host through writing to the wExceptionEventControl attribute. The event bits in the
5445 wExceptionEventStatus attribute and in the Device Information field of the Response UPIU are cleared
5446 by the device when the clear conditions are met.
5447
5448
Page 292
5449 13.4.12 Data transfer rules related with RTT (Ready-to-Transfer)

5450 Data transfer rules related with RTT, simply referred as RTT rules hereafter, have been defined for the
5451 following reasons.
5452  To have same implementation of UFS data transfer mechanism for write transactions across
5453 various host and device vendors
5454  To limit the number of outstanding RTTs in device because of buffer limitation in host side
5455 RTT requests related to several write commands or from different logical units may be interleaved.
5456 The following rules are applicable for device in generating the RTT and the host in handling the RTT.
5457  Rule 1 - Only 1 Data Out UPIU per RTT shall be allowed
5458 o For example, for a Ready To Transfer UPIU RTT N, host will send only one Data Out UPIU
5459 Data N.
Host Device
Write (4MB)
RTT1 (48KB)
Data1 (48KB)
RTT2 (32KB)
Data2 (32KB)
RTT3 (16KB)
Data3 (16KB)
5460
5461 Figure 13.7 — Host-Device interaction example for Rule-1
5462
5463 o If the Data Buffer Offset and/or the Data Transfer Count parameter in the Data Out UPIU
5464 doesn’t match the corresponding parameters in the RTT request, the device shall terminate
5465 the command by sending Response UPIU with UTP Data Out Mismatch Error flag (Flags.D)
5466 set and Status = CHECK CONDITION with SENSE KEY = ABORTED COMMAND. The
5467 following example describes a scenario, where the Data Transfer Count is not matching.
5468
Page 293
5469 13.4.12 Data transfer rules related with RTT (Ready-to-Transfer) (cont’d)
Host Device
Write (4MB)
RTT (32KB)
Data (25KB)
Response (Flags.D)
5470
5471 Figure 13.8 — Host-Device interaction example for Data Out Mismatch Error case
5472  Rule 2 – Device shall not have outstanding RTTs more than specified by host
5473 o bDeviceRTTCap read-only parameter in device descriptor defines the maximum number of
5474 outstanding RTTs which can be supported by device. bMaxNumOfRTT read-write attribute
5475 limits the number of outstanding RTTs generated by the device. bMaxNumOfRTT is equal to
5476 two after device manufacturing, and it may be changed by the host according to its capability
5477 to increase performance. In particular, bMaxNumOfRTT value shall not be set to a value
5478 greater than bDeviceRTTCap value, and it may be set only when the command queues of all
5479 logical units are empty. If host try to write a value higher than specified in bDeviceRTTCap,
5480 the value shall not be changed and the Query Response UPIU shall have Query Response
5481 field set to “Invalid VALUE”. If the host attempts to write bMaxNumOfRTT when there is at
5482 least one logical unit with command queue not empty, the operation shall fail, and Query
5483 Response field in the QUERY RESPONSE UPIU shall be set to FFh (“General failure”).
Host Device
Write (4MB)
RTT1 (48KB)
For example, if bMaxNumOfRTT >= 2

RTT2 (32KB)
Data1 (48KB)
RTT3 (16KB)
Data2 (32KB)
Data3 (16KB)
5484
Page 294
5487  Rule 3 –Across all LUs Data-N for RTT-N shall be transferred before Data-N+1 for RTT-N+1 is
5488 transferred.
5489 o For example, if the host first receives RTT1 and then RTT2 from LUs, it shall send Data1
5490 prior to Data2.
Host Device
Write1 (4MB)
Write2 (8MB)
RTT1 (48KB)
RTT2 (32KB)
Data1 (48KB)
Data2 (32KB)
5491
5493  It is recommended for device to decide the sequence of RTTs based on LU priority, internal
5494 optimization, etc.
5495 o For example, if the write commands belong to the same priority LUs, the device can
5496 determine the order of RTT i.e., device can select optimum sequences to receive the data.
5497
Page 295
Host Device Host Device
Write1 (4MB) Write1 (4MB)
Write2 (8MB) Write2 (8MB)
RTT1 (48KB) RTT2 (32KB)
RTT2 (32KB) RTT1 (48KB)
Data1 (48KB) Data2 (32KB)
Data2 (32KB) Data1 (48KB)
5499
5500 Figure 13.11 — Host-Device interaction for LU with the same priority
5501 o For example, if write command-2 has higher priority than write command-1, then the device
5502 should send RTT for the write command-2 before write command-1.
Host Device
Write1 (32MB)
Write2 (4MB)
Loop { until all data (4MB) is sent }
RTT2 (data_size_n) data_size_n may be changed

per iteration according to the
Data2 (data_size_n) device’s internal status.
Response2
RTT1 (48KB)
Data1 (48KB)
5503
5504 Figure 13.12 — Host-Device interaction for LU with different priorities
Page 296
5507 The following parameters will be defined to implement RTT rules.
5508 Table 13.5 — Parameters for implementing RTT Rules
Defines the current maximum number of outstanding RTTs that is allowed.
bMaxNumOfRTT
This value can be set by the host.
bDeviceRTTCap Defines the maximum number of outstanding RTTs supported by device
UTP Data Out The D flag shall be set to ‘1’ to indicate that a Data Out mismatch error
Mismatch Error Flag(D) occurred during the command transaction
5509
5510
Page 297
5511 13.5 UFS Cache

5512 Cache is a temporary storage space in an UFS device. The cache should in typical case reduce the access
5513 time (compared to an access to the medium) for both write and read. The cache is not directly accessible
5514 by the host but is a separate element in an UFS device. This temporary storage space may be utilized also
5515 for some implementation specific operations like as an execution memory for the memory controller
5516 and/or as storage for an address mapping table etc. but which definition is out of scope of this
5517 specification.
5518 The implementation of the cache is optional for the UFS devices but the related commands shall be
5519 implemented so that compatibility with host SW driver is seamless independent from the implementation.
5520 Devices may explicitly indicate that cache is supported by setting INQUIRY Data VPD page (see [SPC])
5521 parameter V_SUP=1b. V_SUP=0b means that there may or may not be cache implemented. INQUIRY
5522 Data VPD page parameter NV_SUP shall be set to 0b.
5523 The cache is a device level cache and applies for all LUs generically. Data written to and read from a
5524 Boot W-LU and RPMB W-LU shall not be cached due to the specific nature of these LUs.
5525 The cache is expected to be volatile by nature. The cache is not expected to remain data valid over power
5526 cycles or HW/SW resets. The UFS device is expected to manage the cache so that it shall not be possible
5527 to read stale data from the device.
5528 While the cache is implemented the device server may utilize the cache during write and read operations
5529 for storing data which an application client may request later. The algorithm to manage the cache is out of
5530 scope of this standard and is left for the implementation. There are parameters related to the management
5531 of the cache defined in CDBs (see bullets) and in 11.4.2.5, Caching Mode Page.
5532  The disable page out (DPO) bit in the CDB of write, read and verify commands allows the application
5533 client to influence the replacement of the logical blocks in the cache (e.g., in a case the cache is full).
5534 Setting the DPO bit to 1 means that the device server should not replace the existing logical blocks in
5535 the cache with the new logical blocks written or read. When the DPO and FUA bits are set to one,
5536 write and read operations effectively bypass the cache.
5537  The force unit access (FUA) bit in the CDB of write and read commands enables the application
5538 client to access the medium. Setting the FUA bit to 1 means that the device server shall perform the
5539 write to the medium before completing the command and to read logical blocks from the medium (not
5540 from the cache).
5541 During write operations the device server may use the cache to store data that is to be written to the
5542 medium at a later time (write-back caching) and thus the command may complete prior to logical blocks
5543 being written to the medium. This means also that such data may get lost if sudden power loss or reset
5544 occurs. There is also possibility of an error occurring during the actual write operation to the medium
5545 later. If an error occurred during such write operation it may be reported as a deferred error on a later
5546 command.
5547 An UNMAP operation or any other operation which affects data of a logical block in the medium shall
5548 cause the device server to update potential data related to the logical block in the cache accordingly.
5549 It is recommended that the host synchronizes the cache before initiating a PURGE operation.
5550 When a VERIFY command is processed both force unit access and synchronize cache operation are
5551 implied.
5552
Page 298
5553 13.5 UFS Cache (cont’d)

5554 Following commands shall be implemented by the device server to enable application client to control the
5555 behavior of the cache:
5556 • PRE-FETCH commands: see 11.3.19 and 11.3.20
5557 • SYNCHRONIZE CACHE commands: see 11.3.24 and 11.3.25
5558
Page 299
5559 14 UFS DESCRIPTORS, FLAGS AND ATTRIBUTES
5560 14.1 UFS Descriptors

5561 A descriptor is a data structure with a defined format. Descriptors are accessed via QUERY REQUEST
5562 UPIU packets. Descriptors are independently addressable data structures. Descriptors may be stand alone
5563 and unique per device or they may be interrelated and linked in a hierarchical fashion to other descriptors
5564 by parameters defined within the top-level descriptor. Descriptors can range in size from 2 bytes through
5565 255 bytes. A 2 byte descriptor is an empty descriptor. All descriptors have a length value as their first
5566 element. This length represents the entire length of the descriptor, including the length byte. All
5567 descriptors have a type identification as their second byte. A descriptor can be partially read, but starting
5568 point is always the offset 00h.
5569 A Descriptor is a block or page of parameters that describe something about a Device. For example, there
5570 are Device Descriptors, Configuration Descriptors, Unit Descriptors, etc.
5571 In general, all Descriptors are readable, some may be write once, others may have a write protection
5572 mechanism.
5573 The Configuration Descriptor shall be used to configure the UFS device during system integration
5574 Table 14.1 specifies the descriptor identification values.
5575 Table 14.1 — Descriptor identification values
DESCRIPTOR IDN DESCRIPTOR TYPE
00h DEVICE
01h CONFIGURATION
02h UNIT
03h RFU
04h INTERCONNECT
05h STRING
06h RFU
07h GEOMETRY
08h POWER
09h ... FFh RFU
5576 14.1.1 Descriptor Types

5577 Descriptors are classified into types, as indicated in the table above. Some descriptors are singular
5578 entities, such as a Device descriptor. Others can have multiple copies, depending upon the quantity
5579 defined, such as UNIT descriptors. See diagram below.
5580
Page 300
5581 14.1.2 Descriptor Indexing

5582 Each descriptor type has an index number associated with it. The index value starts at zero and increments
5583 by one for each additional descriptor that is instantiated. For example, the first and only Device
5584 Descriptor has an index value of 0. The first String Descriptor will have an index value of 0. The Nth
5585 String Descriptor will have an index value of N-1.
5586 14.1.3 Accessing Descriptors
5587 Descriptors are accessed by requesting a descriptor IDN and a descriptor INDEX. For example, to request
5588 the fifth Unit descriptor, the request would reference TYPE UNIT (numeric value = 2) and INDEX 4
5589 (numeric value = N-1).
DEVICE
STRING STRING STRING STRING

Geometry InterConnect Power CONFIG #1
DEV ID MANU PROD DATE
String String String STRING

UNIT-X UNIT-Y
G1 I1 P1 C1
STRING-UX STRING-UY
5590
5591 Figure 14.1 — Descriptor Organization
5592
5593 All descriptors are read-only, except the Configuration Descriptor and the OEM_ID String Descriptor
5594 which are: readable, writeable if bConfigDescrLock attribute value is equal to 00h.
5595 Configuration Descriptor is used to configure the UFS device during system integration. Parameter
5596 settings in the Configuration Descriptor are used to calculate and populate the parameter fields in the
5597 Device Descriptor and the Unit Descriptors – an internal operation by the device.
5598 The host may write multiple times the Configuration Descriptor if bConfigDescrLock attribute is equal to
5599 zero. Once the Configuration Descriptor is set to the final value, the host sets bConfigDescrLock to one,
5600 and execute a power cycle to complete the device configuration.
5601 NOTE The device behavior may not reflect the Configuration Descriptor setting after power cycle with
5602 bConfigDescrLock equal to zero, the device behavior in this case is device specific.
5603
Page 301
5604 14.1.4 Read Descriptor

5605 A Query Request operation with READ DESCRIPTOR opcode is sent by the host to the device. The host
5606 builds a QUERY REQUEST UPIU places a READ DESCRIPTOR opcode within the UPIU, sets the
5607 appropriate values in the required fields and sends that UPIU to the target device.
5608 Upon reception of the QUERY REQUEST UPIU the device will decode the READ DESCRIPTOR
5609 opcode field and retrieve the descriptor indicated by the DESCRIPTOR IDN field, the INDEX field and
5610 the SELECTOR field . When the device is ready to return data to the Host the device will construct a
5611 QUERY RESPONSE UPIU, set the appropriate fields and place the entire retrieved descriptor within a
5612 single Data Segment area of the QUERY RESPONSE UPIU.
5613 Upon transmission of the QUERY RESPONSE UPIU the device will consider the Query Request
5614 operation complete.
5615 Upon reception of the QUERY RESPONSE UPIU the host will retrieve the requested descriptor from the
5616 Data Segment area, and decode the Status and other fields within the UPIU and take the appropriate
5617 completion action. Upon reception of the QUERY RESPONSE UPIU the host will consider that the
5618 Query Request operation is complete.
5619
Initiator Target
QUERY REQUEST UPIU

READ DESCRIPTOR
TIME
QUERY RESPONSE UPIU

DESCRIPTOR DATA
5620
5621 Figure 14.2 — Read Request Descriptor
5622
5623
Page 302
5624 14.1.5 Write Descriptor

5625 A Query Request operation with WRITE DESCRIPTOR opcode is sent by the host to the device. The
5626 host builds a QUERY REQUEST UPIU places a WRITE DESCRIPTOR opcode within the UPIU, sets
5627 the appropriate values in the required fields and sends that UPIU to the target device. A QUERY
5628 REQUEST UPIU with a WRITE DESCRIPTOR opcode will additionally include a data segment that
5629 contains the descriptor data the Host is sending to the Device.
5630 Upon reception of the QUERY REQUEST UPIU the device will decode the WRITE DESCRIPTOR
5631 opcode field and access the descriptor indicated by the DESCRIPTOR IDN field, the INDEX field and
5632 the SELECTOR field. The device will extract the descriptor data within the data segment of the UPIU and
5633 will internally overwrite the addressed descriptor with the extracted data. When the device has completed
5634 this process it will then notify the Host of the success or failure of this operation by returning to the Host
5635 a QUERY RESPONSE UPIU with the RESPONSE field containing the response code.
5636 When the device has decided that the data transfer has completed the device will build a QUERY
5637 RESPONSE UPIU, place a Status code within RESPONSE field the UPIU, set the appropriate values in
5638 the required fields within the UPIU and send the UPIU to the host. After the transmission of the QUERY
5639 RESPONSE UPIU the target device will consider the operation complete.
5640 Upon reception of the QUERY RESPONSE UPIU the host will decode the RESPONSE field and other
5641 fields within the UPIU and take the appropriate completion action. Upon reception of the QUERY
5642 RESPONSE UPIU the host will consider that the operation is complete.
Initiator Target
QUERY REQUEST UPIU

WRITE DESCRIPTOR
+
DESCRIPTOR DATA
TIME
QUERY RESPONSE UPIU

CONFIRM
DATA WRITTEN
5643
5644 Figure 14-3 — Write Request Descriptor
5645
5646
Page 303
5647 14.1.6 Descriptor Page Definitions

5648 14.1.6.1 Generic Descriptor Format
5649 The format of all descriptors begins with a header which contains the length of the descriptor and a type
5650 value that indentifies the specific type of descriptor. The length value includes the length of the header
5651 plus any additional data.
5652 Table 14.2 — Generic Descriptor Format
DEVICE DESCRIPTOR
Offset Size Name Description
0 1 bLength Size of this descriptor inclusive = N
1 1 bDescriptorType Descriptor Type Identifier
2 … N-1 N-2 DATA Descriptor Information
5653
5654 For unit descriptors, the format is changed to add an indication for the unit being address.
5655
5656 Table 14.3 — Logical Unit Descriptor Format
UNIT DESCRIPTOR
0 1 bLength Size of this descriptor inclusive = N
1 1 bDescriptorType Descriptor Type Identifier
Unit being address

2 1 Unit_INDEX
- 00h to 07h
3 ... N-1 N-3 DATA Descriptor Information

Page 304
5657 14.1.6.2 Device Descriptor

5658 This is the main descriptor and should be the first descriptor retrieved as it specifies the device class and sub-class and the protocol (command set)
5659 to use to access this device and the maximum number of logical units contained within the device. The Device Descriptor is read only, some of its
5660 parameters may be changed writing the corresponding parameter of the Configuration Descriptor.
5661 In a QUERY REQUEST UPIU, the Device Descriptor is addressed setting: DESCRIPTOR IDN = 00h, INDEX = 00h and SELECTOR = 00h.
5662 Table 14.4 — Device Descriptor
DEVICE DESCRIPTOR
User
Offset Size Name MDV (1) Description
Conf.
00h 1 bLength 40h No Size of this descriptor

01h 1 bDescriptorType 00h No Device Descriptor Type Identifier
Device type
02h 1 bDevice 00h No 00h: Device
Others: Reserved
UFS Device Class
03h 1 bDeviceClass 00h No 00h: Mass Storage
Others: Reserved
UFS Mass Storage Subclass
Bits (0/1) specify as follows:
Bit 0: Bootable / Non-Bootable
Bit 1: Embedded / Removable
Bit 2: Reserved (for Unified Memory Extension specification)
Device
04h 1 bDeviceSubClass No Others: Reserved
specific
Examples:
00h: Embedded Bootable
01h: Embedded Non-Bootable
02h: Removable Bootable
03h: Removable Non-Bootable
Protocol supported by UFS Device
05h 1 bProtocol 00h No 00h: SCSI
Others: Reserved
Page 305
DEVICE DESCRIPTOR
User
Conf.
(3) Number of Logical Units

06h 1 bNumberLU 00h Yes
bNumberLU does not include well known logical units.
07h 1 bNumberWLU 04h No Number of Well known Logical Units
Boot Enable
Indicate whether the device is enabled for boot.
08h 1 bBootEnable 00h Yes 00h: Boot feature disabled
01h: Bootable feature enabled
Others: Reserved
Descriptor Access Enable
Indicate whether the Device Descriptor can be read after the partial initialization
phase of the boot sequence
09h 1 bDescrAccessEn 00h Yes
00h: Device Descriptor access disabled
01h: Device Descriptor access enabled
Others: Reserved
Initial Power Mode
bInitPowerMode defines the Power Mode after device initialization or hardware
reset
0Ah 1 bInitPowerMode 01h Yes
00h: UFS-Sleep Mode
01h: Active Mode
Others: Reserved
High Priority LUN
0Bh 1 bHighPriorityLUN 7Fh Yes bHighPriorityLUN defines the high priority logical unit.
Valid values are: from 0 to 7, and 7Fh.
If this parameter value is 7Fh all logical unit have the same priority.
Page 306
DEVICE DESCRIPTOR
User
Conf.
Secure Removal Type

00h: information removed by an erase of the physical memory
01h: information removed by overwriting the addressed locations with a single
character followed by an erase.
0Ch 1 bSecureRemovalType 00h Yes
02h: information removed by overwriting the addressed locations with a
character, its complement, then a random character.
03h: information removed using a vendor define mechanism.
Others: Reserved
Support for security LU
Device 00h: not supported
0Dh 1 bSecurityLU No
specific 01h: RPMB
Others: Reserved
Background Operations Termination Latency
bBackgroundOpsTermLat defines the maximum latency for the termination of
ongoing background operations.
Device When the device receives a COMMAND UPIU with a transfer request, the device
0Eh 1 bBackgroundOpsTermLat No
specific shall start the data transfer and send a DATA IN UPIU or a RTT UPIU within the
latency declared in bBackgroundOpsTermLat.
The latency is expressed in units of 10 ms (e.g., 01h= 10ms, FFh= 2550ms). The
latency is undefined if the value of this parameter is zero.
0Fh 1 bInitActiveICCLevel 00h Yes bInitActiveICCLevel defines the bActiveICCLevel value after power on or reset.
Specification version
Bits[15:8] = Major version in BCD format
10h 2 wSpecVersion 0200h No Bits[7:4] = Minor version in BCD format
Bits[3:0] = Version suffix in BCD format
Example: 3.21=0321h
Page 307
DEVICE DESCRIPTOR
User
Conf.
Manufacturing Date
Device
12h 2 wManufactureDate No BCD version of the device manufacturing date, i.e.
specific
August 2010 = 0810h
Device Manufacturer Name

14h 1 iManufacturerName No
specific Index to the string which contains the Manufacturer Name.
Device Product Name

15h 1 iProductName No
specific Index to the string which contains the Product Name.
Device Serial Number

16h 1 iSerialNumber No
specific Index to the string which contains the Serial Number.
Device OEM ID
17h 1 iOemID No
specific Index to the string which contains the OEM ID.
Manufacturer ID
Device
18h 2 wManufacturerID
specific
No Manufacturer ID as defined in JEDEC standard JEP106 “Standard Manufacturer’s
Identification Code”.
Unit Descriptor 0 Base Offset
1Ah 1 bUD0BaseOffset 10h No Offset of the Unit Descriptor 0 configurable parameters within the Configuration
Descriptor.
Unit Descr. Config. Param. Length
1Bh 1 bUDConfigPLength 10h No
Total size of the configurable Unit Descriptor parameters.
RTT Capability of device
Device
1Ch 1 bDeviceRTTCap No Maximum number of outstanding RTTs supported by device. The minimum value is
specific
2.
Page 308
DEVICE DESCRIPTOR
User
Conf.
Frequency and method of Real-Time Clock update.

Bits [15:10] Reserved
Bits [9] TIME_BASELINE
0h: Time elapsed from the previous dSecondsPassed update.
1h: Absolute time elapsed from January 1st 2010 00:00.
NOTE If the host device has a Real Time Clock it should use TIME
BASELINE = ‘1’. If the host device has no Real Time Clock it should
use TIME BASELINE = ‘0’.
Bits [8:6] TIME_UNIT
1. 0x0 = Undefined
1Dh 2 wPeriodicRTCUpdate 0000h Yes
2. 0x1 = Months
3. 0x2 = Weeks
4. 0x3 = Days
5. 0x4 = Hours
6. 0x5 = Minutes
7. 0x6 = Reserved
8. 0x7 = Reserved
Bits [5:0] TIME_PERIOD
If TIME_UNIT is 0 TIME_PERIOD is ignored and the period between RTC update
is not defined. All fields are configurable by the host.
1Fh 17 Reserved Reserved
30h 16 Reserved Reserved for Unified Memory Extension specification
5663 NOTE 1 The column “MDV” (Manufacturer Default Value) specifies parameter values after device manufacturing. Some parameters may be configured by the
5664 user writing the Configuration Descriptor.
5665 NOTE 2 “User Conf.” column specifies which fields can be configured by the user writing the Configuration Descriptor: “Yes” means that the field can be
5666 configured, “No” means that the field is a capability of the device and cannot be changed by the user. The desired value shall be set in the equivalent parameter of
5667 the Configuration Descriptor.
5668 NOTE 3 bNumberLU field value is calculated by the device based on bLUEnable field value in the Unit Descriptors.
5669
Page 309
5670 wManufacturerID
5671 This parameter contains manufacturer identification information for the device manufacturer. The Manufacturer ID is defined by JEDEC in
5672 Standard Manufacturer’s identification code [JEDEC-JEP106]. The wManufacturerID consists of two fields: Manufacturer ID Code and Bank
5673 Index.
5674 Table 14.5 — wManufacturerID definition
Bit
7 6 5 4 3 2 1 0
Byte
0 Bank Index
1 Manufacturer ID Code
5675 Bank Index

5676 This field contains an index value of the bank that contains the manufacturer identification code. The Bank Index value shall be equal to the
5677 number of the continuation fields that precede the manufacturer identification code as specified by [JEDEC-JEP106].
5678 Manufacturer ID Code
5679 Manufacturer identification code as defined by JEDEC in Standard Manufacturer’s identification code [JEDEC-JEP106].
5680
5681 14.1.6.3 Configuration Descriptor
5682 UFS device shall be configured during system integration by writing the Configuration Descriptor. In particular, the Configuration Descriptor
5683 allows to configure parameters included in the Device Descriptor and in the Unit Descriptors. The Configuration Descriptor can be written if
5684 bConfigDescrLock attribute value is equal to 00h. If bConfigDescrLock attribute value is 01h the Configuration Descriptor is locked and a write
5685 request shall fail.
5686 In a QUERY REQUEST UPIU, the Configuration Descriptor is addressed setting: DESCRIPTOR IDN = 01h, INDEX = 00h and SELECTOR =
5687 00h.
5688
Page 310
5689 14.1.6.3 Configuration Descriptor (cont’d)

5690 Table 14.6 shows the Configuration Descriptor format: the lower address space is used for Configuration Descriptor header and user configurable
5691 parameters included in the Device Descriptor, then there are eight address spaces for user configurable parameters included in the Unit
5692 Descriptors.
5693 Parameter offsets are defined based on:
5694  Offset of the Unit Descriptor 0 configurable parameters within the Configuration Descriptor (B).
5695  Length of Unit Descriptor configurable parameters (L)
5696 Values for B and L are stored in the Device Descriptor parameters bUD0BaseOffset and bUDConfigPLength respectively.
5697 Table 14.6 — Configuration Descriptor Format
Offset Description
00h Configuration Descriptor header and
…
(B-1)h Device Descriptor configurable parameters
(B)h
… Unit Descriptor 0 configurable parameters
(B+L-1)h
(B+L)h
(B+2*L-1)h
… …
(B+7*L)h
(B+8*L-1)h
5698 NOTE 1 B is offset of the Unit Descriptor 0 configurable parameters within the Configuration Descriptor, L is the total size of the configurable Unit Descriptor
5699 parameters.
5700
Page 311

5702 Table 14.7 defines Configuration Descriptor header and Device Descriptor configurable parameters within the Configuration Descriptor.
5703 See 14.1.6.2 ”Device Descriptor” for details about configurable parameters.
5704 Table 14.7 — Configuration Descr. Header and Device Descr. Conf. parameters
Configuration Descriptor Header and Device Descriptor configurable parameters
(1,2)
Offset Size Name MDV Description
00h 1 bLength 90h Size of this descriptor
01h 1 bDescriptorType 01h Configuration Descriptor Type Identifier
02h 1 Reserved
Boot Enable
03h 1 bBootEnable
Enables to boot feature.
Descriptor Access Enable
04h 1 bDescrAccessEn Enables access to the Device Descriptor after the partial initialization phase of the
boot sequence.
Initial Power Mode
05h 1 bInitPowerMode
Configures the power mode after device initialization or hardware reset.
High Priority LUN
06h 1 bHighPriorityLUN
Configures the high priority logical unit.
Secure Removal Type
07h 1 bSecureRemovalType
Configures the secure removal type.
08h 1 bInitActiveICCLevel Configures the ICC level in Active mode after device initialization or hardware
reset
09h 2 wPeriodicRTCUpdate Frequency and method of Real-Time Clock update (see Device Descriptor).
0Bh:0Fh 5 Reserved
5705 NOTE 1 The column “MDV” (Manufacturer Default Value) specifies parameter values after device manufacturing.
5706 NOTE 2 See Table 14.4 “Device Descriptor” for the default parameters value set by the device manufacturer.
Page 312

5708 Table 14.8 defines the Unit Descriptors user configurable parameters within the Configuration Descriptor. See 14.1.6.5 “Unit Descriptor”.
5709
5710 Table 14.8 — Unit Descriptor configurable parameters
Unit Descriptor configurable parameters
00h 1 bLUEnable Logical Unit Enable
01h 1 bBootLunID Boot LUN ID
02h 1 bLUWriteProtect Logical Unit Write Protect
03h 1 bMemoryType Memory Type
Number of Allocation Units

Number of allocation units assigned to the logical unit.
04h 4 dNumAllocUnits
The value shall be calculated considering the capacity
adjustment factor of the selected memory type
08h 1 bDataReliability Data Reliability
09h 1 bLogicalBlockSize Logical Block Size
0Ah 1 bProvisioningType Provisioning Type
0Bh 2 wContextCapabilities Context Capabilities
0Dh:0Fh 3 Reserved
5711
Page 313
5712 14.1.6.4 Geometry Descriptor

5713 The Geometry Descriptor describes the device geometric parameters. In a QUERY REQUEST UPIU, the Geometry Descriptor is addressed
5714 setting: DESCRIPTOR IDN = 07h, INDEX = 00h and SELECTOR = 00h.
5715 Table 14.9 — Geometry Descriptor
GEOMETRY DESCRIPTOR
Offset Size Name Value Description
01h 1 bDescriptorType 07h Geometry Descriptor Type Identifier
02h 1 bMediaTechnology 00h Reserved
03h 1 Reserved 00h Reserved
Total Raw Device Capacity
Device
04h 8 qTotalRawDeviceCapacity Total memory quantity available to the user to configure the device logical units
specific
(RPMB excluded). It is expressed in units of 512 Bytes
0Ch 1 Reserved 00h -
Device Segment Size
0Dh 4 dSegmentSize
specific Value expressed in unit of 512 Bytes
Allocation Unit Size
Device
11h 1 bAllocationUnitSize Value expressed in number of Segments
specific
Each logical unit can be allocated as a multiple of Allocation Units.
Minimum addressable block size
Device
12h 1 bMinAddrBlockSize Value expressed in unit of 512 Bytes.
specific
Its minimum value is 08h, which corresponds to 4 KByte.
Optimal read block size
Device
13h 1 bOptimalReadBlockSize Value expressed in unit of 512 Bytes.
specific
This is optional parameter, 0 = not available.
Device Optimal write block size
14h 1 bOptimalWriteBlockSize
specific Value expressed in unit of 512 Bytes.
Page 314
GEOMETRY DESCRIPTOR
Max. data-in buffer size
Device
15h 1 bMaxInBufferSize Value expressed in unit of 512 Bytes.
specific
Its minimum value is 08h, which corresponds to 4 KByte
Max. data-out buffer size
Device
16h 1 bMaxOutBufferSize Value expressed in unit of 512 Bytes.
specific
Its minimum value is 08h, which corresponds to 4 KByte
Maximum number of RPMB frames (256Byte of data) allowed in Security
Protocol In and Security Protocol Out (i.e., associated with a single command
Device UPIU)
17h 1 bRPMB_ReadWriteSize
specific
If the data to be transferred is larger than bRPMB_ReadWriteSize x 256 bytes,
the host will transfer it using multiple Security Protocol In/Out commands
18h 1 Reserved
Support for out-of-order data transfer

00h: out-of-order data transfer is not supported by the device, in-order data
Device transfer is required.
19h 1 bDataOrdering
specific
01h: out-of-order data transfer is supported by the device
All others: Reserved
Device Max. available number of contexts which are supported by the device. Minimum
1Ah 1 bMaxContexIDNumber
specific number of supported contexts shall be 5.
bSysDataUnitSize provides system data tag unit size, which can be calculated
Device as in the following (in bytes)
1Bh 1 bSysDataTagUnitSize
specific bSysDataTagUnitSize
Tag Unit Size = 2 x bMinAddrBlockSize x 512
Page 315
GEOMETRY DESCRIPTOR
This field is defined to inform the host about the maximum storage area size in
bytes allocated by the device to handle system data by the tagging mechanism:
Device
1Ch 1 bSysDataTagResSize specific ( )
The range of valid bSysDataTagResSize values is from 0 to 6. Values in range

of 7 to 0xFF are reserved.
The formula covers a range from about 0.1% to 6.25% of the device capacity
Supported Secure Removal Types
Bit map which represents the supported Secure Removal types.
bit 0: information removed by an erase of the physical memory
bit 1: information removed by overwriting the addressed locations with a single
character followed by an erase.
Device
1Dh 1 bSupportedSecRTypes bit 2: information removed by overwriting the addressed locations with a
specific
character, its complement, then a random character.
bit 3: information removed using a vendor define mechanism.
Others: Reserved
A value of one means that the corresponding Secure Removal type is
supported.
Page 316
GEOMETRY DESCRIPTOR
Supported Memory Types
Bit map which represents the supported memory types.
bit 0: Normal memory type
bit 1: System code memory type
bit 2: Non-Persistent memory type
bit 3: Enhanced memory type 1
bit 4: Enhanced memory type 2
Device bit 5: Enhanced memory type 3
1Eh 2 wSupportedMemoryTypes
specific bit 6: Enhanced memory type 4
bit 7: Reserved
…
bit 14: Reserved
bit 15: RPMB memory type
A value one means that the corresponding memory type is supported. Bit 0 and
bit 15 shall be one for all UFS device.
Max Number of Allocation Units for the System Code memory type
Device
20h 4 dSystemCodeMaxNAllocU Maximum available quantity of System Code memory type for the entire device.
specific
Value expressed in number of Allocation Unit
Capacity Adjustment Factor for the System Code memory type

Factor used to adjust the memory capacity of this memory property from normal
Device memory:
24h 2 wSystemCodeCapAdjFac
specific
CapacitySystemCode = CapacityNormalMem / CapAdjFac
wSystemCodeCapAdjFac = INTEGER(256 × CapAdjFac)
Page 317
GEOMETRY DESCRIPTOR
Max Number of Allocation Units for the Non-Persistent memory type

Device Maximum available quantity of Non-Persistent memory type for the entire
26h 4 dNonPersistMaxNAllocU
specific device.
Capacity Adjustment Factor for the Non-Persistent memory type

Device memory:
2Ah 2 wNonPersistCapAdjFac
specific
CapacityNonPersist = CapacityNormalMem / CapAdjFac
wNonPersistCapAdjFac = INTEGER(256 × CapAdjFac)
Max Number of Allocation Units for the Enhanced memory type 1

Device
2Ch 4 dEnhanced1MaxNAllocU Maximum available quantity of Enhanced memory type 1 for the entire device
specific
Capacity Adjustment Factor for the Enhanced memory type 1

Device memory:
30h 2 wEnhanced1CapAdjFac
specific
Capacity Enhanced1= CapacityNormalMem / CapAdjFac
wEnhanced1CapAdjFac = INTEGER(256 × CapAdjFac)

Device
32h 4 dEnhanced2MaxNAllocU Maximum available quantity of Enhanced memory type 2 for the entire device
specific
Page 318
GEOMETRY DESCRIPTOR

Device memory:
specific

Device
38h 4 dEnhanced3MaxNAllocU Maximum available quantity of Enhanced memory type 3 for the entire device
specific

Device memory:
3Ch 2 wEnhanced3CapAdjFac
specific

Device
3Eh 4 dEnhanced4MaxNAllocU Maximum available quantity of Enhanced memory type 4 for the entire device
specific

Device memory:
specific
5716 NOTE 1 The Capacity Adjustment Factor value for Normal memory type is one.
Page 319
5717 14.1.6.5 Unit Descriptor

5718 This page describes specific characteristics and capabilities of an individual logical unit, for example geometry of the device and maximum
5719 addressable item. There are up to eight unit descriptors. In a QUERY REQUEST UPIU, an Unit Descriptor is addressed setting: DESCRIPTOR
5720 IDN = 02h, INDEX = unit index, and SELECTOR = 00h.
5721 Table 14.10 — Unit Descriptor
UNIT DESCRIPTOR
(1) User
Conf.
01h 1 bDescriptorType 02h No Unit Descriptor Type Identifier
00h to
02h 1 bUnitIndex No Unit Index
07h
Logical Unit Enable
03h 1 bLUEnable 00h Yes 00h: Logical Unit disabled
01h: Logical Unit enabled
Others: Reserved
Boot LUN ID
00h: Not bootable
04h 1 bBootLunID 00h Yes 01h: Boot LU A
02h: Boot LU B
Others: Reserved.
Logical Unit Write Protect
00h: LU not write protected
05h 1 bLUWriteProtect 00h Yes 01h: LU write protected when fPowerOnWPEn =1
02h: LU permanently write protected when fPermanentWPEn =1
03h: Reserved (for UFS Security Extension specification)
Others: Reserved
Logical Unit Queue Depth
Device
06h 1 bLUQueueDepth
specific
No Queue depth available in this LU. Queue depth of ‘0‘ means best
effort by device to service the command task
07h 1 Reserved 00h No Reserved
Page 320
UNIT DESCRIPTOR
(1) User
Conf.
Memory Type
bMemoryType defines logical unit memory type.
00h: Normal Memory
01h: System code memory type
08h 1 bMemoryType 00h Yes 02h: Non-Persistent memory type
03h: Enhanced memory type 1
Others: Reserved
Data Reliability
bDataReliability defines the device behavior when a power failure
occurs during a write operation to the logical unit
00h: the logical unit is not protected. Logical unit's entire data
09h 1 bDataReliability 00h Yes might be lost as a result of a power failure during a write
operation
01h: logical unit is protected. Logical unit's data is protected
against power failure.
Others: Reserved
Logical Block Size
The size of addressable logical blocks is equal the result of
0Ah 1 bLogicalBlockSize 0Ch Yes exponentiation with as base the number two and as exponent the
bLogicalBlockSize
bLogicalBlockSize value: 2 (i.e., bLogicalBlockSize =
0Ch corresponds to 4 KByte Logical Block Size).
Its minimum value is 0Ch, which corresponds to 4 KByte
Logical Block Count
(3)
0Bh 8 qLogicalBlockCount 00h Yes Total number of addressable Logical Blocks in the LU in Logical
Block Size unit
(4) Erase Block Size

13h 4 dEraseBlockSize 00h No
In number of Logical Blocks
Page 321
UNIT DESCRIPTOR
(1) User
Conf.
Provisioning Type
00h:Thin Provisioning is disabled (default)
17h 1 bProvisioningType 00h Yes 02h:Thin Provisioning is enabled and TPRZ = 0
03h:Thin Provisioning is enabled and TPRZ = 1
Others: Reserved
Physical Memory Resource Count
18h: Device
8 qPhyMemResourceCount No Total physical memory resource available in the logical unit.
1Fh specific
Value expressed in units of Logical Block Size.
Bits [3:0]: MaxContextID is the maximum amount of contexts

that the LU supports simultaneously. The sum of all
MaXContextID must not exceed
bMaxContexIDNumber.
Bits [6:4]: LARGE_UNIT_MAX_MULTIPLIER_M1 is the highest
20h 2 wContextCapabilities 00h Yes multiplier that can be configured for Large Unit
contexts, minus one. Large Unit contexts may be
configured to have a multiplier in the range:
1 ≤ multiplier ≤
(LARGE_UNIT_MAX_MULTIPLIER_M1 + 1)
This field is read only.
Bit [15:7]: Reserved.
Device Granularity of the Large Unit, minus one.
22h 1 bLargeUnitGranularity_M1 No
specific Large Unit Granularity = 1MB * (bLargeUnitGranularity_M1 + 1)
5722 NOTE 1 The column “MDV” (Manufacturer Default Value) specifies parameters value after device manufacturing. Some fields may be configured by the user
5723 writing the Configuration Descriptor.
5724 NOTE 2 “User Conf.” column specifies which fields can be configured by the user writing the Configuration Descriptor: “Yes” means that the field can be
5725 configured, “No” means that the field is a capability of the device and cannot be changed by the user. The desired value shall be set in the equivalent parameter of
5726 the Configuration Descriptor.
5727 NOTE 3 qLogicalBlockCount can be configured setting the dNumAllocUnits parameter of the Configuration Descriptor.
5728 NOTE 4 dEraseBlockSize value is updated automatically by the device after device configuration.
Page 322
5729 14.1.6.6 RPMB Unit Descriptor

5730 In a QUERY REQUEST UPIU, the RPMB Unit Descriptor is addressed setting: DESCRIPTOR IDN = 02h, INDEX = C4h, and SELECTOR =
5731 00h.
5732 Table 14.11 — RPMB Unit Descriptor
RPMB UNIT DESCRIPTOR
User
Conf.
01h 1 bDescriptorType 02h No Unit Descriptor Type Identifier
02h 1 bUnitIndex C4h No Unit Index
Logical Unit Enable
03h 1 bLUEnable 01h No
01h: Logical Unit enabled
Boot LUN ID
04h 1 bBootLunID 00h No
00h: Not bootable
Logical Unit Write Protect
05h 1 bLUWriteProtect 00h No
00h: LU not write protected
Logical Unit Queue Depth
06h 1 bLUQueueDepth 00h No Queue depth available in this LU. Queue depth of ‘0‘ means best
effort by device to service the command task
Memory Type
08h 1 bMemoryType 0Fh No
0Fh: RPMB Memory Type
Logical Block Size
The size of addressable logical blocks is equal the result of
0Ah 1 bLogicalBlockSize 08h No exponentiation with as base the number two and as exponent the
bLogicalBlockSize
bLogicalBlockSize value: 2 (i.e., bLogicalBlockSize =
08h corresponds to 256 Byte Logical Block Size)
Page 323
RPMB UNIT DESCRIPTOR

User
Conf.
Logical Block Count
Device Total number of addressable Logical Blocks of the RPMB LU in
0Bh 8 qLogicalBlockCount No
specific Logical Block Size unit. For RPMB, Logical Block Count shall be a
multiple of 512 (i.e., 128 KByte)
Erase Block Size
13h 4 dEraseBlockSize 00h No In number of Logical Blocks. For RPMB, Erase Block Size is
ignored; set to ‘0’
Provisioning Type
17h 1 bProvisioningType 00h No
00h:Thin Provisioning is disabled
Physical Memory Resource Count
Total physical memory resource available in the logical unit.
18h: Value expressed in units of bLogicalBlockSize.
8 qPhyMemResourceCount No
1Fh The dynamic device capacity feature does not apply to the RPMB
well known logical unit therefore qPhyMemResourceCount value
is always equal to qLogicalBlockCount value
20h:
3 Reserved 0000h
22h
5733
5734
Page 324
5735 14.1.6.7 Power Parameters Descriptor

5736 This descriptor contains information about the power capabilities and power states of the device. In a QUERY REQUEST UPIU, the Power
5737 Parameters Descriptor is addressed setting: DESCRIPTOR IDN = 08h, INDEX = 00h, and SELECTOR = 00h.
5738
5739 Table 14.12 — Power Parameters Descriptor
POWER PARAMETERS DESCRIPTOR
01h 1 bDescriptorType 08h Power Parameters Descriptor Type Identifier
Device 2 byte maximum VCC current value for each of the 16 active
02h 32 wActiveICCLevelsVCC(15:0)
specific current consumption levels starting with level 0
Device 2byte maximum VCCQ current value for each of the 16 active
22h 32 wActiveICCLevelsVCCQ(15:0)
Device 2byte maximum VCCQ2 current value for each of the active
42h 32 wActiveICCLevelsVCCQ2(15:0)
Page 325
5740 14.1.6.8 Interconnect Descriptor

5741 The Interconnect Descriptor MIPI M-PHY specification version number and MIPI UniPro specification
5742 version number. In a QUERY REQUEST UPIU, the Interconnect Descriptor is addressed setting:
5743 DESCRIPTOR IDN = 04h, INDEX = 00h, and SELECTOR = 00h.
5744 Table 14.13 — Interconnect Descriptor
INTERCONNECT DESCRIPTOR
01h 1 bDescriptorType 04h Interconnect Descriptor Type Identifier
MIPI UniPro version number in BCD

02h 2 bcdUniproVersion 0160h
format (i.e., version 3.21=0321h)
MIPI M-PHY version number in BCD

04h 2 bcdMphyVersion 0300h
format (i.e., version 3.21=0321h)
5745
5746 14.1.6.9 Manufacturer Name String Descriptor
5747 This descriptor contains the UNICODE manufacturer name string that may consist of up to 126
5748 UNICODE characters. Number of UNICODE characters is calculated by .
5749 In a QUERY REQUEST UPIU, the Manufacturer Name String Descriptor is addressed setting:
5750 DESCRIPTOR IDN = 05h, INDEX = iManufacturerName (Device Descriptor parameter), and
5751 SELECTOR = 00h.
5752 Table 14.14 — Manufacturer Name String
MANUFACTURER NAME STRING
00h 1 bLength LENGTH Size of this descriptor
01h 1 bDescriptorType 05h String Descriptor Type Identifier
02h 2 UC[0] Unicode string character
04h - - -
LENGTH-2 2 UC[(LENGTH-2)÷2-1] Unicode string character
5753
5754
Page 326
5755 14.1.6.10 Product Name String Descriptor

5756 This descriptor contains the UNICODE product name string that may consist of up to 126 UNICODE
5757 characters. Number of UNICODE characters is calculated by .
5758 In a QUERY REQUEST UPIU, the Product Name String Descriptor is addressed setting:
5759 DESCRIPTOR IDN = 05h, INDEX = iProductName (Device Descriptor parameter), and SELECTOR =
5760 00h.
5761 Table 14.15 — Product Name String
PRODUCT NAME STRING DESCRIPTOR
04h - - -
5762
5763 14.1.6.11 OEM ID String Descriptor
5764 This descriptor contains the UNICODE OEM ID string that may consist of up to 126 UNICODE
5766 In a QUERY REQUEST UPIU, the OEM ID String Descriptor is addressed setting: DESCRIPTOR
5767 IDN = 05h, INDEX = iOemID (Device Descriptor parameter), and SELECTOR = 00h.
5768 OEM_ID String descriptor is: readable, writeable if bConfigDescrLock attribute value is equal to 00h.
5769 Table 14.16 — OEM_ID String
OEM ID STRING DESCRIPTOR
04h - - -

5770
Page 327
5771 14.1.6.12 Serial Number String Descriptor

5772 This descriptor contains the UNICODE serial number string that may consist of up to 126 UNICODE
5774 In a QUERY REQUEST UPIU, the Serial Number String Descriptor is addressed setting:
5775 DESCRIPTOR IDN = 05h, INDEX = iSerialNumber (Device Descriptor parameter), and SELECTOR =
5776 00h.
5777 Table 14.17 — Serial Number String Descriptor
SERIAL NUMBER STRING DESCRIPTOR
04h - - -
5778
5779
Page 328
5780 14.2 Flags

5781 A flag is a single Boolean value that represents a TRUE or FALSE, ‘0’ or ‘1’, ON or OFF type of value.
5782 A flag can be cleared or reset, set, toggled or read. Flags are useful to enable or disable certain functions
5783 or modes or states within the device.
5784 Read access property (read or write only) and write access property (read only, write only, persistent, etc.)
5785 are defined for each flag. Table 14.18 describes the supported access properties for flags.
5786 Table 14.18 — Flags access properties
Access Property Description
Read The flag can be read.

Read
Write only The flag cannot be read.
Read only The flag cannot be written.
The flag can be written only one time during the device lifetime, the value
Write once
is kept after power cycle or any type of reset event.
The flag can be written multiple times, the value is kept after power cycle
Persistent
or any type reset event.
Write The flag can be written multiple times. The flag is set to the default value
Volatile
after power cycle or any type of reset event.
The flag can be only be set to one (or zero) by the host and cleared to
Set only zero (or one) by the device. The flag is cleared after power cycle or any
type of reset event
Power on The flag can be written only one time. The flag is set to the default value
reset after power cycle or hardware reset event
5787
Page 329
5788 14.2 Flags (cont’d)

5789 Table 14.19 — Flags
FLAGS
(1)
Type
(2)
IDN Name Type # Ind. Default Description
(3)
# Sel.
00h Reserved
Device Initialization
Host set fDeviceInit flag to initiate device initialization after boot
Read / process is completed. Device resets flag when device initialization
01h fDeviceInit D 0 is completed.
Set only
0b: Device initialization completed or not started yet.
1b: Device initialization in progress.
Permanent Write Protection Enable

fPermanentWPEn enables permanent write protection on all logical
Read / units configured as permanent protected; it cannot be toggled or
02h fPermanentWPEn D 0
Write once cleared once it is set.
00h: Permanent write protection disabled
01h: Permanent write protection enabled
Page 330
FLAGS
(1)
Type
(2)
(3)
# Sel.
Power On Write Protection Enable

fPowerOnWPEn enables the write protection on all logical units
configured as power on write protected.
If fPowerOnWPEn is equal to one and the device receive a Query
Request to clear or toggle this flag, the Query Request shall fail
Read /
03h fPowerOnWPEn D 0 and Response field shall be set to “F8h” (Parameter already
Power on reset written).
The device shall set fPowerOnWPEn to zero in the event of power
cycle or hardware reset.
0b: Power on write protection disabled.
1b: Power on write protection enabled.
Background Operations Enable

Read / 0b: Device is not permitted to run background operations.
04h fBackgroundOpsEn D 1
Volatile 1b: Device is permitted to run background operations
05h Reserved - Reserved

Page 331
FLAGS
(1)
Type
(2)
(3)
# Sel.
Purge Enable
0b: Purge operation is disabled.
1b: Purge operation is enabled.
Write only / This flag shall only be set when the command queue of all logical
06h fPurgeEnable D 0
units are empty and the bPurgeStatus is 00h (Idle).
Volatile
fPurgeEnable is automatically cleared by the UFS device when the
operation completes or an error condition occurs.
fPurgeEnable can be cleared by the host to interrupt an ongoing
purge operation.
07h Reserved - Reserved
Physical Resource Removal

The host sets this flag to one to indicate that the dynamic capacity
Read / operation shall commence upon device EndPointReset or
08h fPhyResourceRemoval D 0
Persistent hardware reset.
The device shall reset this flag to zero after completion of dynamic
capacity operation. The host cannot reset this flag.
Busy Real Time Clock

0b : Device is not executing internal operation related to RTC
09h fBusyRTC Read Only D 0 1b: Device is executing internal operation related to RTC
When this flag is set to one, it is recommended for the host to not
send commands to the device
Page 332
FLAGS
(1)
Type
(2)
(3)
# Sel.
0Ah Reserved Reserved for Unified Memory Extension specification
Permanently Disable Firmware Update

Read /
fPermanentlyDisableFw 0b: The UFS device firmware may be modified
0Bh Write D 0
Update 1b: The UFS device shall permanently disallow future firmware
once
updates to the UFS device
5790 NOTE 1 The type “D” identifies a device level flag, while the type “A” identifies an array of flags. If Type = “D”, the flag is addressed setting INDEX = 00h and
5791 SELECTOR = 00h.
5792 NOTE 2 For array of flags, ““# Ind.” specifies the amount of valid values for the INDEX field in QUERY REQUEST/RESPONSE UPIU. If # Ind = 0, the flag is
5793 addressed setting INDEX = 00h.
5794 NOTE 3 For array of flags, ““# Sel.” specifies the amount of valid values for the SELECTOR field in QUERY REQUEST/RESPONSE UPIU. If # Sel = 0, the flag is
5795 addressed setting SELECTOR = 00h.
5796
Page 333
5797 14.3 Attributes

5798 An Attribute is a parameter that represents a specific range of numeric values that can be written or read.
5799 For example, the maximum Data In data packet size would be an attribute. Attribute size can be from 1-
5800 bit to 32-bit. Attributes of the same type can be organized in arrays, each element of them identified by
5801 an index. For example, in case of parameter that is logical unit specific, the LUN would be used as index.
5802 Read access property (read or write only) and write access property (read only, write once, persistent,
5803 etc.) are defined for each attribute. Table 14.20 describes the supported access properties for attributes.
5804
5805 Table 14.20 — Attributes access properties
Access Property Description
Read The attribute can be read.

Read
Write only The attribute cannot be read.
Read only The attribute cannot be written.
The attribute can be written only one time during the device lifetime, the value is
Write once
kept after power cycle or any type of reset.
The attribute can be written multiple times, the value is kept after power cycle or
Persistent
Write any type of reset event.
The attribute can be written multiple times. The attribute is set to the default
Volatile
value after power cycle or any type of reset event.
Power on The attribute can be written only one time. The attribute is set to the default
reset value after power cycle or hardware reset event.
5806
Page 334
5807 Table 14.21 — Attributes

ATTRIBUTES
(1)
Type
Access (2) (4)
IDN Name Size # Ind. MDV Description Notes
Property
(3)
# Sel.
Boot LUN Enable

00h: Boot disabled
01h: Enabled boot from Boot LU A
Read / 02h: Enabled boot from Boot LU B
00h bBootLunEn 1 Byte D 00h
Persistent All others: Reserved
When bBootLunEn = 00h the boot feature is
disabled, the device behaves as if bBootEnable
would be equal to 0
01h Reserved
Current Power Mode

00h: Idle mode
10h: Pre-Active mode
Read see 11h: Active mode
02h bCurrentPowerMode 1 Byte D 20h: Pre-Sleep mode 5
only Note 5
22h: UFS-Sleep mode
30h: Pre-PowerDown mode
33h: UFS-PowerDown mode
Others: Reserved
Page 335
ATTRIBUTES
(1)
Type
Access (2) (4)
Property
(3)
# Sel.
Active ICC Level

bActiveICCLevel defines the maximum current
consumption allowed during Active Mode.
Read / see 00h: Lowest Active ICC level
03h bActiveICCLevel 1 Byte D 6
Persistent Note 6 …
0Fh: Highest Active ICC level
Others: Reserved
Out of Order Data transfer Enable

00h: Out-of-order data transfer is disabled.
Read / 01h: Out-of-order data transfer is enabled.
04h bOutOfOrderDataEn 1 Byte D 00h
Write once Others: Reserved
This bit shall have effect only when bDataOrdering
= 01h
Background Operations Status

Device health status for background operation
00h: Not required
05h bBackgroundOpStatus Read only 1 Byte D 00h
01h: Required, not critical
02h: Required, performance impact
03h: Critical.
Others: Reserved
Page 336
ATTRIBUTES
(1)
Type
Access (2) (4)
Property
(3)
# Sel.
Purge Operation Status

00h: Idle (purge operation disabled)
01h: Purge operation in progress
02h: Purge operation stopped prematurely
03h: Purge operation completed successfully
04h: Purge operation failed due to logical unit
06h bPurgeStatus Read only 1 Byte D 00h queue not empty
05h: Purge operation general failure.
Others: Reserved
When the bPurgeStatus is equal to the values
02h, 03h, 04h or 05h, the bPurgeStatus is
automatically cleared to 00h (Idle) the first time
that it is read.
Maximum Data In Size

Maximum data size in a DATA IN UPIU.
Value expressed in number of 512 Byte units.
Read / see bMaxDataInSize shall not exceed the

07h bMaxDataInSize 1 Byte D bMaxInBufferSize parameter. 7, 8
Persistent Note 7
bMaxDataInSize = bMaxInBufferSize when the UFS
device is shipped.
This parameter can be written by the host only
when all LU task queues are empty.
Page 337
ATTRIBUTES
(1)
Type
Access (2) (4)
Property
(3)
# Sel.
Maximum Data-Out Size

Maximum data-size in a DATA-OUT UPIU.
Value expressed in number of 512 Byte units.
Read / bMaxDataOutSize shall not exceed the

08h bMaxDataOutSize 1 Byte D bMaxOutBufferSize parameter. 8
Persistent
bMaxDataOutSize = bMaxOutBufferSize when the
UFS device is shipped.
Dynamic Capacity Needed

A
0000 The amount of physical memory needed to be
09h dDynCapNeeded Read only 4 Bytes 8 (LUN) removed from the physical memory resource pool 9
0000h
0 of the particular logical unit, in units of
bOptimalWriteBlockSize.
Reference Clock Frequency value

0h:19.2MHz
Read / 1h: 26MHz
0Ah bRefClkFreq 1 Byte D 01h
Write once 2h: 38.4MHz
3h: 52MHz
Others: Reserved
Page 338
ATTRIBUTES
(1)
Type
Access (2) (4)
Property
(3)
# Sel.
Configuration Descriptor Lock

Read / 0h: Configuration Descriptor not locked
0Bh bConfigDescrLock 1 Byte D 00h
Write once 1h: Configuration Descriptor locked
Others: Reserved
Maximum current number of outstanding RTTs in

device that is allowed.
Read / bMaxNumOfRTT shall not exceed the
0Ch bMaxNumOfRTT 1 Byte D 02h
Persistent bDeviceRTTCap parameter.
Each bit, if set to ‘1’ by the host, enables the

assertion of the relevant exception event bit,
allowing the device to raise the EVENT_ALERT bit
in the Device Information field in the Response
Read / UPIU:
0Dh wExceptionEventControl 2 Bytes D 0000h
Volatile
Bit 0: DYNCAP_EVENT_EN
Bit 1: SYSPOOL_EVENT_EN
Bit 2: URGENT_BKOPS_EN
Bit 3 -15: Reserved
Page 339
ATTRIBUTES
(1)
Type
Access (2) (4)
Property
(3)
# Sel.
Each bit represents an exception event. A bit will be

set only if the relevant event has occurred
(regardless of the wExceptionEventControl status).
0Eh wExceptionEventStatus Read only 2 Bytes D 0000h Bit 0: DYNCAP_NEEDED
Bit 1: SYSPOOL_EXHAUSTED
Bit 2: URGENT_BKOPS
Bit 3 -15: Reserved
0000 Bits[31:0]: Seconds passed from TIME BASELINE

0Fh dSecondsPassed Write only 4 Bytes D
0000h (see wPeriodicRTCUpdate in Device Descriptor)
Page 340
ATTRIBUTES
(1)
Type
Access (2) (4)
Property
(3)
# Sel.
INDEX specifies the LU number. SELECTOR

specifies the Context ID within the LU.
Valid values are 01h – Fh.
Bit[15:8]: RFU
Bit[7:6]: Reliability mode
00h: MODE0 (normal)
01h: MODE1 (non-Large Unit, reliable mode or
Large Unit unit-by-unit mode)
02h: MODE2 (Large Unit, one-unit-tail mode)
03h: Reserved
Bit[5:3]: Large Unit multiplier
A If Large Unit context is set, this field defines the

Large Unit size, else it is ignored
Read /
10h wContextConf 2 Bytes 8 (LUN) 0000h
Volatile Bit[2]: Large Unit context
15 (ID) 00h: Context is not following Large Unit rules
01h: Context follows Large Unit rules
Bit [1:0]: Activation and direction mode
00b: Context is closed and is no longer active
01b: Context is configured and activated as a
write-only context and according to the rest
of the bits in this configuration register.
read-only context and according to the rest
of the bits in this configuration register
read/write context and according to the rest
of the bits in this configuration register
Page 341
ATTRIBUTES
(1)
Type
Access (2) (4)
Property
(3)
# Sel.
A
0000 Amount of logical blocks which were successfully
11h dCorrPrgBlkNum Read Only 4 Bytes 8 (LUN)
0000h programmed by the last write command.
0
Reserved for Unified Memory Extension

12h Reserved
specification
5808
5809 NOTE 1 The type “D” identifies a device level attribute, while the type “A” identifies an array of attributes. If Type = “D”, the attribute is addressed setting INDEX =
5810 00h and SELECTOR = 00h.
5811 NOTE 2 For array of attributes, “# Ind.” specifies the amount of valid values for the INDEX field in QUERY REQUEST/RESPONSE UPIU. If # Ind = 0, the
5812 attribute is addressed setting INDEX = 00h.
5813 NOTE 3 For array of attributes, “# Sel.” specifies the amount of valid values for the SELECTOR field in QUERY REQUEST/RESPONSE UPIU. If # Sel = 0, the
5814 attribute is addressed setting SELECTOR = 00h.
5815 NOTE 4 The column “MDV” (Manufacturer Default Value) specifies attribute values after device manufacturing.
5816 NOTE 5 bCurrentPowerMode value after device initialization may be: 20h (Pre-Sleep mode) or 22h (UFS-Sleep mode) if bInitPowerMode = 00h, or 11h (Active
5817 Mode) if bInitPowerMode = 01h.
5818 NOTE 6 bActiveICCLevel after power on or reset is equal bInitActiveICCLevel parameter value included in the Device Descriptor. bInitActiveICCLevel is equal to
5819 00h after device manufacturing and can be configured during system integration.
5820 NOTE 7 bMaxDataInSize = bMaxInBufferSize when the UFS device is shipped.
5821 NOTE 8 If the host attempts to write this Attribute when there is at least one logical unit with command queue not empty, the operation shall fail, and Response
5822 field in the QUERY RESPONSE UPIU shall be set to FFh (“General failure”).
5823 NOTE 9 dDynCapNeeded is composed by eight elements, one for each logical unit. The desired element shall be selected assigning the LUN to INDEX field of
5825
Page 342
5826 ANNEX A - DYNAMIC CAPACITY HOST IMPLEMENTATION EXAMPLE (INFORMATIVE)
5827 A.1 Overview

5828 This standard defines the Dynamic Capacity feature to enable a UFS device to regain at least partial
5829 functionality at the end-of-life where the defect level of the storage medium has accumulated to the point
5830 where the device can no longer maintain normal functionality.
5831 Dynamic Capacity operation allows the device, at the direction of the host system, to remove physical
5832 memory resource from the resource pool dedicated for data storage and re-task the resource for device
5833 internal utility, thus restoring device functionality.
5834 The net result of the Dynamic Capacity operation is a reduction of the usable storage space in the physical
5835 medium while the logical address space remains the same as before – i.e., the physical storage is less than
5836 the logical address space. It is the responsibility of the host system to keep track of the reduction in
5837 physical storage to maintain normal operation in its file system.
5838 This application note outlines a method for the host file system to account for the reduction in physical
5839 storage with minimal impact.
5840 A.2 Method Outline
5841 1. The host system receives notification from the device in the Device Information parameter in
5842 Response UPIU that the device requires physical memory to be freed up from the storage space to
5843 continue operation.
5844 2. The host reads the bDynCapNeeded[LUN] attributes and the bOptimalWriteBlockSize parameter
5845 in the Device Descriptor to determine how much physical memory resource needs to be freed up
5846 in each logical unit.
5847 3. The host identifies the logical block address range(s) in the file system where the data can be
5848 discarded/erased to free up the physical memory resource. The host then uses the UNMAP
5849 command to unmap (deallocate) the LBA range(s), and initiates the Dynamic Capacity operation
5850 by setting the fPhyResourceRemoval flag and resetting the UFS device.
5851 4. The host can mark the particular LBA range(s) as unusable in its file system by the means of
5852 dummy file(s) to ensure these LBA’s will not be used in future write operations. The unusable
5853 LBA’s marked by dummy file(s) match the reduction of physical storage, therefore from the host
5854 system perspective, the file system is intact.
5855 5. The host can further backup the unusable LBA information by storing the information in the
5856 system area in case the file system of the main data storage logical unit is corrupted.
Page 343
ANNEX B (INFORMATIVE) DIFFERENCES BETWEEN JESD220B AND JESD220A
B.1 Changes between JESD220B and its predecessor JESD220A

B.1.1 New features or new definitions
The following items were added
 HS-GEAR3 support (optional)
 Multi-lane support (two lanes, optional)
 New 6.5.1 “HS Gear Rates” , Defined HS-BURST rates
 New 6.7 “Absolute Maximum DC Ratings”, Defined absolute maximum DC ratings for signal
voltages, power supply voltages, and storage temperature.
 New 7.2 “Power up ramp”, Defined requirements for power up ramp.
 New 7.3 “Power off ramp”, Defined requirements power off ramp.
 Mode Page Policy VPD support (see 11.3.2.1 “VITAL PRODUCT DATA”)
 New 11.3.21 “SECURITY PROTOCOL IN Command”
 New 11.3.22 “SECURITY PROTOCOL OUT Command”
B.1.2 Changes in section 2 “Normative Reference”
 M-PHYSM specification: from version 2.00.00 to version 3.0.
 Unified Protocol (UniProSM) specification: from version 1.41.00 to version 1.6.
B.1.3 Changes in features already defined in UFS 1.1
Changes for features already defined in the previous version of the specification are summarized in the
following
 4.1 “General Features”, Mandatory support for HS-GEAR2
 5.4.3 “MIPI UniPro Related Attributes”, DME_DDBL1_ManufacturerID and
DME_DDBL1_DeviceClass, Used Attribute names defined in [MIPI-UniPro] and fixed Attribute ID
value.
 5.5.1.1 “Client-Server Model”, Deleted the sentence: “Only one Task can be processed at a time
within a Logical Unit. If a device contains multiple Logical Units, it could have the ability to process
multiple Tasks simultaneously or concurrently if so designed.”.
 7.3.1 “EndPointReset”, Deleted the sentence “Note that if the device has already completed the
initialization phase before receiving the EndPointReset, it is not required to set fDeviceInit to ‘1‘ and
wait until the device clears it.”.
Page 344
B.1.3 Changes in features already defined in UFS 1.1 (cont’d)

 7.4.1 “Device Power Modes”, Clarified logical unit response to SCSI commands for each power
mode. UFS-Sleep power mode: added the sentence: “VCC power supply should be restored before
issuing START STOP UNIT command to request transition to Active power mode or PowerDown
power mode.”. Figure “Power Mode State Machine”: added Powered On power mode, arrow from
Active to Pre-Sleep with “bInitPowerMode=00h”, and some notes. Defined all power mode
transitions. Added the sentence: “The effects of concurrent power mode changes requested by
START STOP UNIT commands with the IMMED bit set to one are vendor specific.”. Added the
sentence: “A START STOP UNIT command with the IMMED bit set to zero causing a transition to
Active, Sleep, or PowerDown power modes shall not complete with GOOD status until the device
reaches the power mode specified by the command.”. Added 7.4.1.9 “Device Well Know Logical
Unit Responses to SCSI commands”
 New 7.4.4 “Logical Unit Power Condition”
 8.6 “UFS PHY Attributes” , Added the following M-PHYSM Attributes:
TX_Hibern8Time_Capability, TX_Advanced_Granularity_Capability,
TX_Advanced_Hibern8Time_Capability, TX_HS_Equalizer_Setting_Capability,
RX_Hibern8Time_Capability, RX_PWM_G6_G7_SYNC_LENGTH_Capability,
RX_HS_G2_SYNC_LENGTH_Capability, RX_HS_G3_SYNC_LENGTH_Capability,
RX_HS_G2_PREPARE_LENGTH_Capability, RX_HS_G3_PREPARE_LENGTH_Capability,
RX_Advanced_Granularity_Capability, RX_Advanced_Hibern8Time_Capability,
RX_Advanced_Min_ActivateTime_Capability.
 9.6.6 “UniPro Attributes”, Added the UniProSM PA_MaxDataLanes constant, PA_AvailTxDataLanes
and PA_AvailRxDataLanes Attributes.
 Table 10.17 — Sense Key, Deleted the sentence: “The UNIT ATTENTION condition will remain set
until an explicit REQUEST SENSE has been issued to the target.”
 10.5.5 “DATA OUT UPIU”, Added the sentence: “Note that in case out of order DATA OUT UPIUs,
the last data portion may not be transmitted by the final UPIU.”.
 10.5.6 “DATA IN UPIU”, Added the sentence: “Note that in case out of order DATA IN UPIUs, the
final data portion may not be transmitted by the last UPIU.”
 10.5.7 “READY TO TRANSFER UPIU”
Added the sentence: “The Data Buffer Offset shall be an integer multiple of four.”.
Added the sentence: “The Data Transfer Count field shall be always an integer multiple of four bytes
except for RTT which requests the final portion of data in the transfer.”.
 New 10.5.10.12 “NOP”
Defined NOP OPCODE for QUERY REQUEST UPIU.
 10.5.11 “QUERY RESPONSE UPIU”, Added Device Information in byte 9 of QUERY RESPONSE
UPIU. Defined Query Response value for invalid Query Function field and OPCODE field
combinations.
 New 10.5.11.14 “NOP”, Defined NOP OPCODE for QUERY RESPONSE UPIU.
 11.3.2.4 “Inquiry Response Data”, Added the sentence: “The 4-byte PRODUCT REVISION LEVEL
in the Inquiry Response Data shall identify the firmware version of the UFS device and shall be
uniquely encoded for any firmware modification implemented by the UFS device vendor.”.”
Page 345
B.1.3 Changes in features already defined in UFS 1.1 (cont’d)

 11.4.2 “UFS Supported Pages”, Defined default value and changeable fields for the following Mode
Pages: Control Mode Page, Read-Write Error Recovery Mode Page, Caching Mode Page.
 12.4.6 “RPMB Operations”, Changed Command Set Type field value from 1h to 0h.
 13.1.3.1 “Partial initialization”, During device initializialization is no longer required to send a
sequence of NOP OUT UPIU: the host sends only one NOP OUT UPIU.
 13.1.3.3 “Initialization completion” , Added a table to clarify which are the valid UPIUs and SCSI
commands for each initialization phase.
 13.2.3 “Logical Unit Configuration”
Added the sentence: “Supported bLogicalBlockSize values are device specific, refer to the vendor
datasheet for further information”.
Added the sentence: “The Capacity Adjustment Factor value for Normal memory type is one.”
 13.4.4 “Background Operations Mode”
Removed the requirement of having empty command queues for starting background operations.
Added bBackgroundOpsTermLat (Background Operations Termination Latency) parameter in Device
Descriptor.
Defined URGENT_BKOPS = 0 if bBackgroundOpStatus = 1.
 13.4.7 “Data Reliability”
Increased data reliability granularity from 512Byte to logical block size.
Defined RPMB data reliability granularity (bRPMB_ReadWriteSize × 256 bytes)
 13.4.12 “Data transfer rules related with RTT (Ready-to-Transfer)”
Added the sentence: “RTT requests related to several write commands or from different logical units
may be interleaved.”
 14.1.6.2 “Device Descriptor”
bDeviceSubClass: reserved bit 2 for Unified Memory Extension specification.
Changed bNumberLU manufacturer default value (MDV) from 01h to 00h.
Added bBackgroundOpsTermLat parameter.
Reserved bytes for Unified Memory Extension specification.
Clarified wManufacturerID definition.
 14.1.6.3 “ Configuration Descriptor” Removed bNumberLU (because this parameter is no longer
configurable).
 14.1.6.5 “Unit Descriptor” bLUWriteProtect: reserved the value 03h for UFS Security Extension
specification.
 14.2 “Flags”: Added fPermanentlyDisableFwUpdate (Permanently Disable Firmware Update) flag.
 14.3 “Attributes”: Changed bRefClkFreq manufacturer default value (MDV) from 00h to 01h.
Several clarifications were added and editorial changes were implemented in addition to what
summarized above.
Page 346
STANDARD IMPROVEMENT FORM JEDEC
The purpose of this form is to provide the Technical Committees of JEDEC with input from the industry
regarding usage of the subject standard. Individuals or companies are invited to submit comments to
JEDEC. All comments will be collected and dispersed to the appropriate committee(s).
If you can provide input, please complete this form and return to:
JEDEC Fax: 703.907.7583

Attn: Publications Department
th
3103 North 10 Street
Suite 240 South
1. I recommend changes to the following:

Requirement, clause number
Test method number Clause number
The referenced clause number has proven to be:

Unclear Too Rigid In Error
Other
2. Recommendations for correction:
3. Other suggestions for document improvement:
Submitted by
Name: Phone:
Company:
E-mail:
Address:
City/State/Zip: Date:

JESD220B

Uploaded by

Copyright:

Available Formats

JESD220B

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

JESD220B

Uploaded by

Copyright:

Available Formats

JEDEC

Universal Flash Storage (UFS)

JEDEC SOLID STATE TECHNOLOGY ASSOCIATION

PRICE: Contact JEDEC

Printed in the U.S.A.

This document is copyrighted by JEDEC and may not be

For information, contact:

JEDEC Solid State Technology Association

or refer to www.jedec.org under Standards-Documents/Copyright Information.

UNIVERSAL FLASH STORAGE (UFS), VERSION 2.0

7.3 Power off ramp 34

10.4.1 UPIU Transaction Codes 62

11.3.4 MODE SENSE (10) Command 156

12.5 Malware Protection 260

Table 5.1: UFS Signals ............................................................................................................................... 13

Table 9.1: DME Service Primitives ............................................................................................................ 58

Table 10.43: Query Function opcode values ............................................................................................ 106

Table 11.8: Mode Sense Command Parameters ...................................................................................... 157

Table 11.52: Read Buffer Command Mode Field Values......................................................................... 211

Table 13.5: Parameters for implementing RTT Rules .............................................................................. 296

1 UNIVERSAL FLASH STORAGE (UFS), VERSION 2.0

33 3 TERMS AND DEFINITIONS

39 3.1 Acronyms (cont’d)

59 3.2 Terms and Definitions (cont’d)

133 3.5 Conventions

193 4.2 Interface Features

224 5 UFS ARCHITECTURE OVERVIEW

225 5.1 UFS Top level Architecture

UFS Command Set Layer (UCS)

UDM_SAP UTP_CMD_SAP UTP_TM_SAP

UFS Transport Protocol Layer (UTP)

249 5.1 UFS Top level Architecture (cont’d)

UFS InterConnect UFS Transport Protocol

UFS InterConnect UFS Transport Protocol

267 5.1 UFS Top level Architecture (cont’d)

304 5.2 UFS System Model

UFS Host UFS Device

REF_CLK Control Config

330 5.4 UFS Interconnect (UIC) Layer

DIN_t Downstream lane input

DOUT_t Upstream lane output

344 5.4.2 MIPI UniPro

357 5.4 UFS Interconnect (UIC) Layer (cont’d)

MIPI manufacturer ID.

DME_DDBL1_ManufacturerID 0x5003 MIPI MID shall be used in this

Memory = 0x02 UniPro DeviceClass ID for UFS

390 5.5 UFS Transport Protocol (UTP) Layer (cont’d)

424 5.5.1.1 Client-Server Model (cont’d)

428 5.5.1.1 Client-Server Model (cont’d)

UFS Unit Task Router

433 5.5.1.2 CDB, Status, Task Management

468 5.6 UFS Application and Command Layer

508 6 UFS ELECTRICAL: CLOCK, RESET, SIGNALS AND SUPPLIES

509 6.1 Embedded UFS Signals

VCC VCCQ VCCQ2

524 6.1 Embedded UFS Signals (cont’d)

Input reference clock. When not active, this signal should be

Differential input signals into UFS device from the host

526 6.2 UFS Memory Card Signals

528 6.3 Reset Signal