11/9/23, 6:22 PM eMMC working mode · Linux Kernel Internals

eMMC working mode

Overview
TODO:Add Pic
When the eMMC Device is in Power On, HW Reset or SW Reset, the Host can trigger eMMC
Boot and let the eMMC enter Boot Mode. In this mode, the eMMC Device will send Boot Data to
the Host, which is usually the system startup code, such as BootLoader.
If the Host does not trigger the Boot process or after the Boot process is completed, the eMMC
Device will enter Device Identification Mode. In this mode, the eMMC Device will be initialized,
and the Host will set the operating voltage, negotiate the addressing mode, and assign the RCA
device address for the eMMC Device.
After Device Identification Mode ends, it will enter Data Transfer Mode. In this mode, the Host
can initiate data reading and writing processes.
After entering Data Transfer Mode, the Host can initiate a command to let the eMMC Device
enter Interrupt Mode. In this mode, the eMMC Device waits for internal interrupt events, such as
completion of writing data, etc. When the eMMC Device receives an internal interrupt event, it
will send a Response to the Host, then switch to Data Transfer Mode and wait for the Host's
subsequent data read and write commands.

Boot Operation Mode

Boot From eMMC Device

TODO: Add Boot States
After Power On, HW Reset or SW Reset, if the eMMC Device has Boot Mode enabled (that is,
the register bit BOOT_PARTITION_ENABLE (EXT_CSD byte [179]) specifies the boot partition),
then the Host has two ways to allow the eMMC Device to enter Boot. Mode, respectively defined
as Original Boot and Alternative Boot, as follows:
1. Original Boot: pull down the CMD signal and maintain it for no less than 74 clock cycles
2. Alternative Boot: Keep the CMD signal high, and after 74 clock cycles, send
the CMD0 command with parameter 0xFFFFFFFA.
After entering Boot Mode, the eMMC Device will select one of the two Boot partitions and UDA
according to the setting of the register bit BOOT_PARTITION_ENABLE to read the Boot Data
with a size of 128KB × BOOT_SIZE_MULT (EXT_CSD byte [226]) and send it to the Host
through Data Lines .
During the process of Boot Data data transmission, the Host can interrupt the data transmission
and end the Boot Mode early. The method is as follows:
1. Original Boot: During the transmission process, pull up the CMD signal
2. Alternative Boot: During the transmission process, send the CMD0 command with the
parameter 0xF0F0F0F0

https://linux-codingbelief-com.translate.goog/zh/storage/flash_memory/emmc/emmc_modes.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr… 1/9
11/9/23, 6:22 PM eMMC working mode · Linux Kernel Internals

NOTE: The Host sends the CMD0

command with the parameter 0xF0F0F0F0 to allow the eMMC Device to perform SW
Reset. The Host pulls the RST_n signal high to trigger the eMMC Device to perform HW
Reset.

Boot Acknowledge
If the register bit BOOT_ACK (EXT_CSD byte [179]) is set to 1, the eMMC Device will send a
"010" Boot ACK on DAT0 to the Host within 50 ms of the Host triggering Boot Mode.
The timing diagram including Boot ACK is as follows:
TODO: Add Original Boot Pic
TODO: Add Alternative Boot Pic

Boot Bus configuration

EXT_CSD byte [177] The BOOT_BUS_CONDITIONS register is used to configure the bus
status of data transmission in Boot Mode.
Through the BOOT_BUS_CONDITIONS register configuration, in Boot Mode, the bus can
support the following modes:

Max
Data Bus Data
Mode Frequency
Rate Width Transfer
(x8)
Backward x1,
Single 0-26 MHz 26MB/s
Compatible x4, x8
High
x1,
Speed ​ Single 0-52 MHz 52MB/s
x4, x8
SDR
High
Speed ​ Dual x4, x8 0-52 MHz 104MB/s
DDR

The BOOT_BUS_CONDITIONS register can also configure whether to reset or retain the current
bus configuration after exiting Boot Mode. If configured as reset, the bus will be reset to
Backward Compatible SDR x1 mode after exiting Boot Mode. If configured as retained, after
exiting Boot Mode, the bus will retain the bus mode in Boot Mode.
NOTE:
The BOOT_BUS_CONDITIONS register has a nonvolatile attribute, and the configuration
content will not be lost when the power is off.
If the eMMC Device has not gone through Boot Mode, the BOOT_BUS_CONDITIONS
register will not change the bus mode.
After exiting Boot Mode, the bus mode can also be configured through the HS_TIMING and
BUS_WIDTH registers.

https://linux-codingbelief-com.translate.goog/zh/storage/flash_memory/emmc/emmc_modes.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr… 2/9
11/9/23, 6:22 PM eMMC working mode · Linux Kernel Internals

Boot Data Update

When the eMMC Device is shipped from the manufacturer, it has no stored content and no Boot
Mode enabled. To use eMMC Devcie products, you need to start a download system through
other methods (for example, through USB, UART, etc.), write Boot Data and other system data
to eMMC, enable Boot Mode and set Boot Bus mode. Then, the product can start the software
system from the eMMC Device.
The update of Boot Data is similar to the writing of other data. For more details of data writing,
please refer to the Data Transfer Mode section.

Device Identification Mode

If the Host does not trigger the Boot process or after the Boot process is completed, the eMMC
Device will enter Device Identification Mode.

TODO:Add States
The eMMC Device will enter the Idle State of Device Identification Mode after exiting Boot Mode
or after Power On, HW Reset or SW Reset when Boot Mode is not enabled.
In the Idle State , the eMMC Device will perform internal initialization. The Host needs to
continuously send CMD1 commands to check whether the eMMC Device has completed
initialization, and at the same time negotiate the operating voltage and addressing mode.

The parameters of the CMD1 command sent by the Host include the operating voltage and
addressing mode information supported by the Host. After receiving this information, the eMMC
Device will match. If the operating voltage and addressing mode supported by the eMMC Devcie
and Host do not match, the eMMC Device will enter the Inactive State .
After receiving the CMD1 command, the eMMC Device will return the contents of the OCR
register to the Host through Response, which contains the flag bit of whether the eMMC Device
has completed initialization, the device operating voltage range Voltage Range and the memory
access mode Memory Access Mode information .

After the eMMC Device completes initialization, it will enter the Ready State . In this State, the
Host will send the CMD2 command to obtain the CID of the eMMC Device.

CID, which is Device identification number, is used to identify an eMMC Device. It contains the
eMMC Device's manufacturer, OEM, device name, device serial number, production year and
other information. The CID of each eMMC Device is unique and will not be exactly the same as
other eMMC Devices.
After receiving CMD2 , the eMMC Device will return the contents of the 127-bit CID register to
the Host through Response.

After sending the CID, the eMMC Device will then enter the Identification State . Then, the
Host will send a CMD3 command with parameters including 16 Bits RCA to allocate RCA to the
eMMC Device.
After setting the RCA, eMMC Devcie completes Devcie Identification and enters Data Transfer
Mode.

NOTE:
This section only describes the Devcie Identification process of a single eMMC Device. The
Device Identification process of multiple eMMCs is similar to this. For more details, please
refer to the eMMC Spec.

https://linux-codingbelief-com.translate.goog/zh/storage/flash_memory/emmc/emmc_modes.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr… 3/9
11/9/23, 6:22 PM eMMC working mode · Linux Kernel Internals

Voltage Range
eMMC Device supports two operating voltage modes: 3.3v and 1.8v. In 1.8v mode, eMMC
Device will save more power.

TODO: Describe how to set or switch different operating voltage modes

Memory Access Mode

Memory Access Mode determines how the eMMC Device accesses the internal memory when
responding to the Host's data read and write requests. There are two Memory Access Modes in
the eMMC standard: Byte Access Mode and Sector Access Mode.

In the Command for data reading and writing, the Host will send the read and write address A to
the eMMC Device as a parameter of the Command. In Byte Access Mode, the eMMC Device will
start reading and writing operations from the Ath Byte, and in Sector Access Mode Under this
condition, the eMMC Device will start reading and writing operations from the A-th Sector. The
size of a Sector is 512 Bytes or 4 KBytes. A larger Sector supports larger capacity memory
access.
Using Byte Access Mode is more flexible and efficient, but due to the limitation of addressing
bits, storage content exceeding 2GB cannot be accessed. Sector Access Mode supports access
to large-capacity storage. The 512 Bytes Sector can support storage access with a maximum
capacity of 256 GB. For larger capacity requirements, a 4 KBytes Sector can be used.

RCA - Relative device Address

RCA is a 16-bit device address assigned by the Host during the Devcie Identification process. It
is mainly used to select the specific eMMC Devcie to be operated when communicating in Data
Transfer Mode.

The RCA allocated by the Host usually increases from 1, and the 0 address is used as the
broadcast address. The RCA register of eMMC Devcie saves the RCA allocated by the Host.
TODO: Confirm whether the value of RCA register is lost after power failure and restart.

Data Transfer Mode

After the eMMC Device completes Device Identification, it will enter the Standby State of Data
Transfer Mode.
In the Standby State, the Host can send the CMD5 command to make the eMMC Devcie enter
the low-power Sleep State, and then send the CMD5 command to make the eMMC Device exit
the Sleep State.

In the Standby State, the Host can send the CMD7 command to make the eMMC Devcie enter
the Transfer State, and then send the CMD7 command to make the eMMC Device exit the
Transfer State.

Read Data
In Transfer State, the Host can send the following commands to trigger the data reading
process:
https://linux-codingbelief-com.translate.goog/zh/storage/flash_memory/emmc/emmc_modes.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr… 4/9
11/9/23, 6:22 PM eMMC working mode · Linux Kernel Internals

Order describe
CMD8 Read EXT_CSD register data
Starting from the specified address,
CMD17
read the data of a Block
Starting from the specified address,
CMD18
read the data of multiple Blocks
CMD21 Read Tuning Block data

When the eMMC Device receives the above CMDs, it will enter the Sending-data State. In this
state, the eMMC Device will continue to send data to the Host until the transmission of the
specified number of data blocks is completed or the CMD12 transmission stop command sent by
the Host is received. After the eMMC Device stops sending data, it will return to Transfer State.

If the Host sends a CMD23 that sets the Block Count to be read before sending CMD18 . The
eMMC Device automatically ends the data transmission after completing the data transmission
of the specified Block Count. There is no need for the Host to actively send the stop
command CMD12 .

If the Host does not send the Command to set the Block Count to be read, after sending the
Multiple Block Read Command, the eMMC Device will continue to send data until the Host
sends the Stop Command to stop data transmission.
NOTE: If you send CMD23 to set the Block Count to be read before sending CMD18 , then
the eMMC Device will automatically stop sending data after sending the specified number of
Blocks.

Write Data
In Transfer State, the Host can send the following commands to trigger the data writing process:

Order describe
CMD24 Write data to a Block
CMD25 Write data to multiple Blocks
CMD26 Write CID register value
CMD27 Write CSD register value

NOTE:
The CID register value can usually only be written once. Some bits determined by the
manufacturer during production and written into the CSD register value can be rewritten
multiple times.

When the eMMC Device receives the above CMDs, it will enter the Receive-data State. In this
State, the eMMC Devcie will continue to receive data from the Host and store it in the internal
Buffer or register.
If the Host sends a CMD23 that sets the Block Count to be written before sending CMD25 . The
eMMC Device automatically ends data transmission after completing the data reception of the
specified Block Count, and does not require the Host to actively send the stop
command CMD12 .

https://linux-codingbelief-com.translate.goog/zh/storage/flash_memory/emmc/emmc_modes.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr… 5/9
11/9/23, 6:22 PM eMMC working mode · Linux Kernel Internals

If the Host does not send the Command to set the Block Count that needs to be written, after
sending the Command of Multiple Block Write, the eMMC Device will continue to receive data
until the Host sends the Stop Command to stop data transmission.

When eMMC Device starts a write operation, it will first store the received data in the internal
Buffer, and then write the data in the Buffer to Flash in the background. Normally, the Host sends
data faster than the eMMC writes to Flash, so the internal Buffer will be full. At this time, the
eMMC Devcie will pull the DAT0 signal line low as the Busy signal. After the Host receives the
Busy signal, it will pause sending data and wait until the eMMC Device has processed part of
the data in the Buffer and released the Busy signal before re-sending the data.
When the eMMC Device completes data reception, it will enter the Programming State and write
the remaining unwritten data in the internal Buffer to Flash. In this state, the eMMC Device will
continue to pull DAT0 low as a Busy signal. If a new write command is received before the write
is completed, the eMMC Device will immediately return to the Receive-data State to receive
data; if a new write command is not received before the write is completed, the eMMC Device
will After completing the write, return to Transfer State.
If the eMMC Devcie is in the Programming State and has not completed the write operation and
receives a CMD7 command with parameters not equal to its own RCA, then the eMMC Device
will enter the Disconnect State. In this State, the eMMC Device will continue to perform writing
operations, and after the writing is completed, it will enter the Stand-by State.
If the eMMC Device is in the Disconnect State and has not completed the write operation and
receives a CMD7 command with parameters equal to its own RCA, then the eMMC Devcie will
return to the Programming State.

Packed Commands - Packed Write and Packed Read

In actual application scenarios, there are usually many random data read and write operations
on eMMC Devices. The target addresses of these random reads and writes are often not
consecutive. Each random read and write needs to go through an independent read and write
process. accomplish.

In eMMC 4.5 and later standards, the Packed Commands mechanism is introduced to
encapsulate multiple data write requests with discontinuous addresses into a Multiple Block
Write process, and at the same time encapsulate multiple data read requests with discontinuous
addresses into one In the Multiple Block Read process, this reduces the number of read and
write requests and improves the efficiency of data reading and writing.
TODO: Add Packed Read and Packed Write pic

Packed Write
When initiating the Packed Write process, the Host first needs to send
the CMD23 SET_BLOCK_COUNT command with the packed flag set to 1. Among them, the
Block Count parameter in CMD23 is the total number of Blocks occupied by the Packed
Command Header and the actual written data.
Then the Host sends the CMD25 command to the eMMC Device to start writing data to multiple
blocks. The first (or first 8) Block data is the Packed Command Header, which contains
information such as the starting address and length of the data written by each write request.
After receiving the data, eMMC Devcie will write the data to the specified location based on the
information of the Packed Command Header.

https://linux-codingbelief-com.translate.goog/zh/storage/flash_memory/emmc/emmc_modes.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr… 6/9
11/9/23, 6:22 PM eMMC working mode · Linux Kernel Internals

Packed Read
When initiating the Packed Read process, the Host first needs to send
the CMD23 SET_BLOCK_COUNT command with the packed flag set to 1. Among them, the
Block Count parameter in CMD23 is the number of Blocks occupied by the Packed Command
Header.
Then the Host sends the CMD25 command to the eMMC Device and starts sending 1 (or 8)
Block Packed Command Header data. Packed Command Header contains information such as
the starting address and length of data read by each read request.
After sending the Packed Command Header, the Host will send
another CMD23 SET_BLOCK_COUNT command with the packed flag set to 1. Among them, the
Block Count parameter in CMD23 is the number of Blocks to be read.
Immediately afterwards, the Host sends the CMD18 command to start reading data of multiple
blocks. eMMC Devcie will parse the received Packed Command Header and then send the
specified data to the Host.

NOTE:
The Host does not need to send the second CMD23 command. In this case, the Host needs
to actively send the Stop command to notify the eMMC Device to stop sending data.

Packed Command Header

TODO: add packed command header pic
The format of the Packed Command Header is as shown in the figure above, where
CMD23_ARG_x indicates the number of Blocks for each requested data to be read or written,
and CMDxx_ARG_x (CMD18 or CMD25) indicates the starting position for each requested data
to be read or written.
When DATA_SECTOR_SIZE[61] = 0x00, that is, when the Data Sector Size is 512 Bytes, the
Packed Command Header occupies 1 Block size. When DATA_SECTOR_SIZE[61] = 0x01, that
is, when the Data Sector Size is 4 KBytes, the Packed Command Header occupies 8 Block size.
NOTE:
For the error handling process of Packed Command, please refer to the description in the
eMMC Spec document, which will not be described in detail here.

data erasure
The eMMC standard provides several methods of actively erasing data to meet the needs of
different scenarios.

https://linux-codingbelief-com.translate.goog/zh/storage/flash_memory/emmc/emmc_modes.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr… 7/9
11/9/23, 6:22 PM eMMC working mode · Linux Kernel Internals

Erase Erase
describe
method unit
Press Erase Group to
erase the data. After
completion, re-reading
Erase will return data with all 0
Erase
Group or 1, but the original
data may still be
retained on the physical
storage medium.
Press Write Block to
erase the data. After
completion, re-reading
Write will return data with all
TRIM
Block 0s or 1s, but the original
data may still be
retained on the physical
storage medium.
Press Write Block to
erase the data. Re-
Write
Discard reading after completion
Block
may return the data
before erasing.
Clear the data of the
block marked for
Sanitize -
erasure on the physical
media

Erase

The Erase operation performs data erasure of one or more Groups in Erase Group units. An
Erase Group consists of one or more Write Blocks.
When an eMMC Device performs an Erase operation, it usually does not erase the actual
physical data. It just unmaps the Block in the Erase Group to be erased from the address space,
and then selects the completed physical erase from the free Block in the background. Block,
remap to the address space, and then notify the Host that the Erase operation has been
completed. The actual physical erasure operation is performed in the background at the
appropriate time.
Such logic can reduce the waiting time for the Host to perform the Erase operation and improve
the response speed of the eMMC Devcie.
When initiating the Erase process, the Host will first send the CMD23 SET_BLOCK_COUNT
command whose parameter is the starting address of the Erase Group to be erased.

https://linux-codingbelief-com.translate.goog/zh/storage/flash_memory/emmc/emmc_modes.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr… 8/9
11/9/23, 6:22 PM eMMC working mode · Linux Kernel Internals

TRIM

Discard

Sanitize

Interrupt Mode
TODO

https://linux-codingbelief-com.translate.goog/zh/storage/flash_memory/emmc/emmc_modes.html?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr… 9/9