System and method for improving security with respect to a clearing operation in a universal flash device

Abstract

Systems and methods for enhancing the security of Universal Flash Storage (UFS) devices during wipe operations. If a wipe operation performed on a UFS device is prematurely interrupted due to the issuance of one or more emergency commands, the UFS device notifies the host processor that the wipe operation has been interrupted. After the host processor executes the emergency commands, the host processor causes the UFS device to resume execution of the wipe operation, and the host processor delays the execution of any other commands arriving in the host processor's Command Queue (CQ) until the resumed wipe operation has been completed. Because the wipe operation is resumed and completed before the host processor executes any other commands that have arrived in the CQ, die-level attacks seeking access to undrudged data by sending read commands to the host processor's CQ are prevented.

Description

[0001] Related technical descriptions

[0002] Computing devices may include multiple processor-based subsystems. Such computing devices may be, for example, portable computing devices (“PCDs”), such as laptops or handheld computers, cellular phones or smartphones, portable digital assistants, portable game consoles, etc. Other types of PCDs may be included in automotive and Internet of Things (“IoT”) applications. Computing devices may also be stationary computers, such as personal computers (PCs) or various types of desktop computers or workstation computers.

[0003] Such processor-based subsystems can be included within the same integrated circuit chip or on different chips. A "system-on-a-chip" (SoC) is an example of such a chip that integrates numerous subsystems to provide system-level functionality. For example, an SoC may include one or more types of processors, such as a central processing unit ("CPU"), a graphics processing unit ("GPU"), a digital signal processor ("DSP"), and a neural processing unit ("NPU"). An SoC may also include other subsystems, such as a transceiver or "modem" subsystem providing wireless connectivity, a memory subsystem, and so on.

[0004] Computing devices also include various types of memory devices used by processing units to store data and computer instructions, including, for example, Universal Flash Storage (UFS) devices. The Joint Electronic Equipment Committee (JEDEC) UFS 4.0 standard was developed for mobile applications and computing systems requiring high performance and low power consumption. This standard introduces significant bandwidth and data protection improvements for UFS devices. Section 12.2.2.4 of the JEDEC UFS 4.0 standard states that a cleanup operation should be performed on physical blocks that are not used to store logical block data (e.g., physical blocks previously used to store logical block data). The cleanup operation results in the permanent deletion of the data stored in the corresponding physical block. The cleanup operation is designed to protect against die-level attacks, such as a malicious actor installing an application on the host processor that accesses the UFS device and reads data that the malicious actor should not have access to.

[0005] According to this standard, a purge operation can be performed if the fPurgeEnable flag is set to 1 (i.e., purge is enabled), and cannot be performed if the fPurgeEnable flag is set to 0 (i.e., purge is disabled). The purge operation is initiated by the host processor. If the host processor's command queue is empty for all logical units (LUNs) of the UFS device, the fPurgeEnable flag can be set to 1 only (i.e., purge is enabled). If a purge operation is in progress, the UFS device sets the purge status attribute bPurgeStatus to 01h. If a purge operation is in progress (bPurgeStatus=01h), commands sent to any LUN of the UFS device or to a well-known Replay Protected Memory Block (RPMB) LUN of the UFS device will fail. In such cases, the UFS device returns a sense key "Not Ready" to the host processor to indicate that the command failed because the purge operation is in progress. While a purge operation is in progress, descriptors, attributes, and flags can be read, but only the fPurgeEnable flag can be written.

[0006] In some cases, the ongoing cleanup operation may be interrupted. For example, if the UFS device signals to the host processor that it immediately needs to perform an urgent command or background operation (an operation corresponding to affected or critical performance), the cleanup operation will be interrupted or aborted. When the host processor detects a request to execute an urgent command or background operation, it will begin executing the urgent command or multiple commands based on the demand level. For example, a background operation with attribute value 02h indicates that performance is being affected, while a background operation with attribute value 03h indicates that performance is critical and therefore has a higher demand level.

[0007] The occurrence of certain critical events in a UFS device will also cause the wipe operation to be interrupted, namely, dynamic device capability (DYNCAP_NEEDED), emergency background operation (URGENT_BKOPS), write-enhanced refresh (WRITEBOOSTER_FLUSH_NEEDED), overheating (TOO_HIGH_TEMP), underheating (TOO_LOW_TEMP), and performance throttling (PERFORMANCE_THROTTLING).

[0008] If the host processor needs to execute an urgent command (e.g., URGENT_BKOPS, DYNCAP_NEEDED) while the purge operation is in progress, the host processor may interrupt the purge operation. In such cases, the host processor sets the fPurgeEnable flag to zero, waits until the UFS device interrupts the purge operation and notifies the host processor that the purge operation has been interrupted, and then sets the bPurgeStatus attribute to 02h to indicate that the purge operation stopped prematurely.

[0009] This process of interrupting the wipe operation can be problematic. One issue is that when the host processor aborts an ongoing wipe operation, once an urgent command is processed, the wipe operation is not resumed / retried; instead, any command in the host processor's command queue will begin processing. Currently, there is no mechanism in the standard to re-trigger a wipe operation that was prematurely aborted. Because the wipe operation is not resumed, a die-level attack on the physical blocks of undone flash memory can retrieve all undone data present in those physical blocks, which defeats the security purpose of the wipe operation. Another problem is that the host processor must restart the wipe operation from scratch by re-initiating the wipe request, which increases latency.

[0010] A way is needed to improve UFS security regarding cleanup operations. Summary of the Invention

[0011] Systems, methods, and other examples for improving the security of UFS devices during cleanup operations are disclosed.

[0012] Exemplary implementations of this method include:

[0013] In this UFS device, if a cleanup operation in the UFS device is interrupted due to the issuance of at least one emergency command, the host processor is notified that the cleanup operation has been interrupted.

[0014] In this host processor, emergency commands are stored in the command queue (CQ) and executed; and

[0015] In the host processor, after an emergency command has been executed, the cleanup operation is resumed in the UFS device.

[0016] An exemplary embodiment of the system includes a UFS device and a host processor. The UFS device includes control logic configured to output a notification that the cleanup operation has been interrupted due to the issuance of at least one emergency command. The host processor includes processing logic configured to receive the notification, store the emergency command in the host processor's CQ, execute the emergency command, and, after the emergency command has been executed, resume the cleanup operation in the UFS device.

[0017] An exemplary embodiment of a computer program embodied on a non-transitory computer-readable medium includes a first set of computer instructions for execution by control logic of a UFS device and a second set of computer instructions for execution by processing logic of a host processor. The first set of computer instructions outputs a notification from the UFS device that a cleanup operation has been interrupted due to the issuance of at least one emergency command. The second set of computer instructions receives the notification in the host processor, stores the emergency command in the host processor's CQ, executes the emergency command, and, after executing the emergency command, causes the cleanup operation to be resumed in the UFS device.

[0018] Another exemplary embodiment of the system includes: components for outputting a notification from the UFS device that the cleanup operation has been interrupted due to the issuance of at least one emergency command; components for receiving the notification in the host processor; components for storing the emergency command in the CQ of the host processor; components for executing the at least one emergency command in the host processor; and components for resuming the cleanup operation in the UFS device after the at least one emergency command has been executed.

[0019] These and other features and advantages will become apparent from the following description, drawings and claims. Attached Figure Description

[0020] In the accompanying drawings, unless otherwise indicated, similar reference numerals are used throughout the various views to refer to similar parts.

[0021] Figure 1 A transaction diagram illustrating how interrupted cleanup operations can be retried and resumed to improve security in UFS devices, based on a representative implementation, is presented.

[0022] Figure 2 A block diagram illustrating a system for improving the security of UFS in performing cleanup operations, according to an exemplary embodiment, is shown.

[0023] Figure 3 A flowchart illustrating a method for improving the security of a UFS device during a wipe operation, according to a representative implementation, is provided.

[0024] Figure 4An example is given of the preferred embodiment. Figure 3 The flowchart represents the method of the flowchart, where Figure 3 The steps shown are implemented in a specific manner within the framework of the JEDEC UFS 4.0 standard.

[0025] Figure 5 Examples of PCDs are illustrated, including exemplary embodiments of systems, methods, computer-readable media, and other examples that can implement the principles and concepts of the present invention according to this disclosure. Detailed Implementation

[0026] This disclosure discloses systems and methods for improving the security of wipe operations in UFS devices. According to a representative embodiment, if a wipe operation performed in a UFS device is prematurely interrupted due to the issuance of one or more emergency commands, the UFS device notifies the host processor that the wipe operation has been interrupted. After the host processor executes the emergency command, the host processor causes the UFS device to resume the execution of the wipe operation, and the host processor delays the execution of any other commands arriving in the host processor's command queue (CQ) until the resumed wipe operation has been completed. Because the interrupted wipe operation is resumed and completed before the host processor executes any other commands that have arrived in the CQ, bare-chip level attacks seeking access to undrudged data by sending read commands to the host processor's CQ are prevented.

[0027] In the following detailed description, exemplary or representative embodiments of the specific details disclosed are set forth for purposes of explanation and not limitation, in order to provide a thorough understanding of embodiments according to this teaching. The word “exemplary” is used herein to mean “serving as an example, instance, or illustration.” The words “illustrative” or “representative” are used herein synonymously with “exemplary.” Any aspect described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other aspects. However, it will be apparent to those skilled in the art, who benefit from this disclosure, that other embodiments of the present teaching that depart from the specific details disclosed herein remain within the scope of the appended claims. Furthermore, descriptions of well-known apparatuses and methods may be omitted so as not to obscure the description of exemplary embodiments. Such methods and apparatus are clearly within the scope of this teaching.

[0028] The terminology used herein is for the purpose of describing particular implementations only and is not intended to be limiting. The defined terms are supplementary to their technical and scientific meanings as generally understood and accepted in the technical field of this teaching content.

[0029] Unless the context clearly indicates otherwise, the terms “a,” “an,” and “the” as used in the specification and appended claims include both singular and plural references. Thus, for example, “an apparatus” includes one apparatus and multiple apparatuses.

[0030] Relative terms are used to describe the relationships between individual elements, as illustrated in the accompanying drawings. In addition to the orientations depicted in the drawings, these relative terms are intended to cover different orientations of the equipment and / or elements.

[0031] It should be understood that when an element is described as being "connected to," "coupled to," or "electrically coupled to" another element, the element may be directly connected or coupled, or there may be intermediate elements present.

[0032] As used herein, the term "memory device" is intended to refer to a non-transitory, computer-readable storage medium capable of storing computer instructions or computer code that can be executed by one or more processors. References to "memory device" herein should be interpreted as including one or more memory devices.

[0033] As used herein, the term "processor" encompasses an electronic component capable of executing computer programs or computer instructions. References to a computer including "processor" herein should be interpreted as one or more processors. A processor may, for example, be a multi-core processor comprising multiple processing cores, each of which may include multiple processing stages in a processing pipeline. A processor may also refer to a collection of processors within a single system or distributed across multiple systems.

[0034] As used herein, the term "logic unit" refers to digital circuitry that is combined and configured in a particular manner to implement one or more specific functions, such as digital gate structures. For example, a control logic unit can be a combination of digital circuitry that has been combined and configured in a particular manner to implement one or more specific control functions, whether alone in hardware or in a combination of hardware, software, and / or firmware.

[0035] Computing devices may include multiple subsystems, cores, or other components. Such computing devices may be, for example, PCDs, such as laptops or handheld computers, cellular phones or smartphones, portable digital assistants, portable game consoles, car security systems, etc., or non-portable computing devices (NPCDs), such as PCs, desktop computers, or workstation computers.

[0036] As used herein, the term “emergency command” refers to any event or command that will abort a cleanup operation, including but not limited to background operations that have an impact on or are critical to performance, and commands that are considered urgent, such as Dynamic Device Capability (DYNCAP_NEEDED), Emergency Background Operation (URGENT_BKOPS), Write Enhanced Refresh (WRITEBOOSTER_FLUSH_NEEDED), Overheating (TOO_HIGH_TEMP), Underheating (TOO_LOW_TEMP), and Performance Throttling (PERFORMANCE_THROTTLING).

[0037] Figure 1 A transaction diagram illustrating a method for enhancing security in UFS devices by re-triggering and resuming interrupted wipe operations according to a representative embodiment is provided. For illustrative purposes, the transaction diagram assumes that transactions conform to the JEDEC UFS 4.0 standard, but the principles and concepts of the invention are not limited to this standard. As those skilled in the art will understand from the description provided herein, standards are frequently updated or replaced, and therefore the principles and concepts of the invention disclosed herein are applicable to providing security regarding wipe operations to UFS and other flash memory devices.

[0038] According to the principles and concepts of this invention, after the host processor has executed an emergency command, but before the host processor executes any other commands (e.g., read and write commands) that arrived in the host processor's command queue (CQ) during the restored cleanup operation, the cleanup operation that was interrupted by the issuance of the emergency command is restored and completed. Any other commands sent to the CQ during the restored cleanup operation are stored in a wait queue (WaitQ) until the restored cleanup operation is completed and then loaded into the CQ. This additional security eliminates the possibility of a successful die-level attack. For example, a die-level attack could be performed by having the host processor run an application that causes the host processor to issue commands to access data stored in un-cleaned physical blocks. Because any such commands will not move from the WaitQ to the CQ until the restored cleanup operation is completed, the data will be cleaned up when the commands are loaded into the CQ, thus preventing the attack.

[0039] refer to Figure 1Arrow 101 indicates that the host processor initiates a purge operation by sending a UFS Protocol Information Unit (UPIU) command to the UFS device, which sets the fPurgeEnable flag to 1, enabling the purge operation to proceed. This causes the UFS device to set the bPurgeStatus attribute to 01h, which is transmitted to the host processor as a UPIU response to notify the host processor that the purge operation is in progress. According to this transaction example, while the purge operation is in progress, the UFS device notifies the host processor that an urgent command needs to be executed by the host processor, as indicated by arrow 102. As indicated by arrow 103, the host processor then prematurely aborts the purge operation by sending a command to the UFS device to set the fPurgeEnable flag to zero, thereby disabling the purge operation.

[0040] The UFS device then sets the bPurgeStatus attribute to 02h to indicate that the purge operation was prematurely aborted and sends a UPIU bPurgeStatusResponse, as indicated by arrow 104, to the host processor to notify the host processor that the purge operation has been aborted. It should be noted that this UPIU bPurgeStatusResponse is a new response type not covered by the JEDEC UFS 4.0 standard. According to this example, reserved bit field 17 of the transaction-specific field that marks the opcode is used for this purpose, but other bit fields can also be used for this purpose.

[0041] The host processor then processes the emergency command already loaded into its CQ, as indicated by arrow 105. After the emergency command is processed, the host processor resumes the purge operation by sending a UPIU command to the UFS device, which instructs the UFS device to set the fPurgeEnable flag to one to enable the resumption of the purge operation, as indicated by arrow 106.

[0042] As indicated above, any commands sent to the host processor's CQ (Call Queued) between the time the purge operation is aborted and the time the recovered purge operation completes, except for urgent commands, are stored in the WaitQ queue and are only loaded into the CQ upon completion of the recovered purge operation. Once the recovered purge operation is complete, the UFS device sends a UPIU response with bPurgeStatus = 03h to the host processor to indicate that the recovered purge operation has been completed, as indicated by arrow 107. The host processor then loads the commands waiting in the WaitQ into the CQ for processing.

[0043] Figure 2A block diagram illustrating a system 200 for improving the security of UFS in performing wiping operations, according to an exemplary embodiment, is shown. A host processor 201 communicates with a UFS device 210 via a host-to-UFS interface 202 to perform the operations described above. Figure 1 The type of transaction described. Host processor 201 includes those configured to execute the above reference. Figure 1 The logical components of the described process, as well as the logical components of additional processes configured to perform (not discussed herein for the sake of brevity), are described. Similarly, UFS device 210 includes components configured to perform the processes referenced above. Figure 1 The logical components of the described process, as well as the logical components configured to perform additional processes not discussed herein for the sake of brevity.

[0044] The host processor 201's WaitQ 203 stores any commands other than emergency commands, which are sent to the host processor 201's CQ 204 between the moment the purge operation is aborted and the moment the recovered purge operation completes. When an emergency command is issued, it is immediately loaded into CQ 204. Once the recovered purge operation has completed, the commands stored in WaitQ 203 are loaded into CQ 204 for processing. The host processor 201 also includes one or more registers 205 for storing the current values ​​of the fPurgeEnable flag and the bPurgeStatus attribute. Registers 205 can be any suitable memory of the host processor 201.

[0045] The interface logic unit 211 of the UFS device 210 is configured to interface with the host-to-UFS interface 202 and with the control logic unit 220 of the UFS device 210. The control logic unit 220 is configured to perform the above-mentioned references. Figure 1 The tasks described herein, as well as additional tasks beyond the scope of this disclosure and not discussed herein for the sake of brevity, are also included. Control logic unit 220 also includes one or more registers 221 for storing the current values ​​of the fPurgeEnable flag and the bPurgeStatus attribute. Registers 221 can be any suitable memory of control logic unit 220. The flash memory 230 of UFS device 210 contains physical blocks of flash memory cells that are addressed based on instructions from control logic unit 220 to perform write, read, erase, and clear operations.

[0046] As will be described in more detail below, the host processor 201 and the host-to-UFS interface 202 may be components of the SoC 240, which may be implemented in, for example, a PCD such as a mobile phone. However, it should be noted that, as those skilled in the art will understand from the description provided herein, the principles and concepts of the invention are not limited to being part of any particular device or implemented in any particular device or used for any particular application.

[0047] Figure 3 A flowchart illustrating a method for enhancing the security of a UFS device during a wipe operation, according to a representative embodiment, is provided. If the wipe operation in the UFS device is interrupted due to the issuance of at least one emergency command, the UFS device notifies the host processor that the wipe operation has been interrupted, as indicated in box 301. The host processor stores the emergency command in a CQ, retrieves the emergency command from the CQ, and executes the emergency command, as indicated in box 302. After the emergency command has been executed, the host processor causes the wipe operation to be resumed in the UFS device, as indicated in box 303.

[0048] As those skilled in the art will understand from the description provided herein, Figure 3 The steps represented by boxes 301-303 can be performed in many different ways. Figure 4 An example is given of the preferred embodiment. Figure 3 The flowchart represents the method of the flowchart, where Figure 3 The steps shown are implemented in a specific manner within the framework of the JEDEC UFS 4.0 standard. It should be noted that... Figure 4 The flowchart is an example of one of many ways that can be implemented within the framework of the JEDEC UFS 4.0 standard, and the principles and concepts of the invention are not limited to that standard.

[0049] exist Figure 3 Before the step of interrupting the purge operation at box 301, when an emergency command is issued, the host processor stores the emergency command in the CQ and sends a command to the UFS device to de-assert the purge enable flag, as indicated in box 401. As indicated above, according to the JEDEC UFS 4.0 standard, the purge enable flag is the fPurgeEnable flag. The de-assertification of the purge enable flag causes the UFS device to interrupt the purge operation. The UFS device then notifies the host processor that the purge operation has been interrupted at box 301 by setting the purge status attribute to a first value (e.g., 02h in the standard) and sending the first purge status attribute value to the host processor in a response notifying the host processor that the purge operation has been interrupted, as indicated in box 402. As indicated above, in the JEDEC UFS 4.0 standard, the purge status attribute is the bPurgeStatus attribute.

[0050] When the cleanup operation is interrupted, the host processor executes an emergency command and causes any new commands arriving at the CQ after the cleanup operation was interrupted (i.e., any commands other than the emergency command) to be stored in the WaitQ, as indicated in box 403. After any emergency command has been executed, the host processor re-asserts the cleanup enable flag to allow the UFS device to resume the interrupted cleanup operation, as indicated in box 404. While the resumed cleanup operation is in progress, the host processor causes any new commands arriving at the CQ to be stored in the WaitQ.

[0051] After the restored wipe operation is complete, the UFS device sets the wipe status attribute to a second value indicating that the restored wipe operation has been completed (e.g., 03h in the standard) and sends the second wipe status attribute value to the host processor to notify the host processor that the restored wipe operation has been completed, as indicated in box 405. Upon receiving the second wipe status attribute value indicating that the restored wipe operation has been completed, the host processor moves any commands waiting in the WaitQ to the CQ, retrieves the commands from the CQ, and executes the retrieved commands, as indicated in box 406. The process of storing commands sent to the CQ in the WaitQ and moving commands from the WaitQ to the CQ is preferably implemented in software and / or firmware executed by the host processor, but may also be implemented in hardware or a combination of hardware and software and / or firmware.

[0052] Figure 5 Examples of PCD 500 are illustrated, such as mobile phones, smartphones, portable game consoles (such as extended reality (XR) devices, virtual reality (VR) devices, augmented reality (AR) devices, or mixed reality (MR) devices), etc., in which exemplary embodiments of systems, methods, computer-readable media, and other examples of the principles and concepts of the present invention according to this disclosure can be implemented. PCD 500 includes SoC 502, which includes... Figure 2 The system 200 shown above may be used to perform the above-mentioned references. Figures 1 to 4 Similar systems to the described method. For clarity, Figure 5 Some interconnecting components and signals are not shown. For ease of illustration, the UFS device 210 is shown in... Figure 5 It is shown as being inside the SoC 502, but it can also be outside the SoC 502.

[0053] SoC 502 may include CPU 201, NPU 505, GPU 506, DSP 507, analog signal processor 508, modem / modem subsystem 554, and / or other processors. Any processor in SoC 502 can function as... Figure 2The host processor 201 shown is in operation, but for illustrative purposes, it is assumed that... Figure 5 The CPU 201 shown is as Figure 2 The host processor 201 is shown in the diagram. Typically, multiple processors of SoC 502 will be coupled to UFS device 210 and will operate as host processors relative to UFS device 210. It should be noted that SoC 502 may include multiple UFS devices 210. It should also be noted that the host processor does not need to be part of the SoC.

[0054] CPU 201 may include one or more CPU cores, such as first CPU core 2011, second CPU core 2012, etc., up to the Mth CPU core 201. M Display controller 509 and touchscreen controller 512 may be coupled to CPU 201. A touchscreen display 514 external to SoC 502 may be coupled to display controller 509 and touchscreen controller 512. PCD 500 may also include a video decoder 516 coupled to CPU 201. Video amplifier 518 may be coupled to video decoder 516 and touchscreen display 514. Video port 520 may be coupled to video amplifier 518. Universal Serial Bus (“USB”) controller 522 may also be coupled to CPU 501, and USB port 524 may be coupled to USB controller 522. User identity module (“SIM”) card 526 may also be coupled to CPU 201.

[0055] One or more memory modules 528 may be coupled to CPU 201. The one or more memory modules 528 may include both volatile and non-volatile memory. Examples of volatile memory include static random access memory (“SRAM”), dynamic random access memory (“DRAM”), double data rate synchronous DRAM (DDR SDRAM), etc. Such memory may be external to SoC 502 or internal to SoC 502. The one or more memory modules 528 may also include local cache memory or system-level cache memory.

[0056] A stereo audio codec 534 may be coupled to an analog signal processor 508. An audio amplifier 536 may be coupled to the stereo audio codec 534. A first stereo speaker 538 and a second stereo speaker 540 may be coupled to the audio amplifier 536, respectively. Furthermore, a microphone amplifier 542 may be coupled to the stereo audio codec 534, and a microphone 544 may be coupled to the microphone amplifier 542. An FM radio tuner 546 may be coupled to the stereo audio codec 534. An FM antenna 548 may be coupled to the FM radio tuner 546. Additionally, a stereo headset 550 may be coupled to the stereo audio codec 534. Other devices that may be coupled to the CPU 201 include one or more digital (e.g., CCD or CMOS) cameras 552.

[0057] RF modem / transceiver 554 may be coupled to analog signal processor 508 and CPU 201. RF switch 556 may be coupled to RF modem / transceiver 554 and RF antenna 558. Keypad 560 and mono headset 562 with microphone may be coupled to analog signal processor 508. SoC 502 may have one or more internal or on-chip thermal sensors 570. Power supply 574 and power management integrated circuit (“PMIC”) 576 may power SoC 502.

[0058] Firmware or software may be stored in any of the memories described above, or in local memory directly accessible to the processor hardware executing the software or firmware thereon. The execution of such firmware or software by the logical components of UFS device 210 and CPU 201 may control aspects of any of the methods described above or configure aspects of any of the systems described above. Any such memory or other non-transitory storage medium having firmware and / or software stored therein in a computer-readable form for execution by processor hardware can be an example of a "computer-readable medium," as understood in the patent dictionary.

[0059] Specific implementation examples are described in the following numbered clauses:

[0060] 1. A method for enhancing the security of a Universal Flash Storage (UFS) device during a wipe operation, the wipe operation being designed to delete data stored in one or more physical blocks of flash memory in the UFS device, the method comprising:

[0061] In the UFS device, if a cleanup operation in the UFS device is interrupted due to the issuance of at least one emergency command, the host processor is notified that the cleanup operation has been interrupted.

[0062] In the host processor, the at least one emergency command is stored in a command queue (CQ) and the at least one emergency command is executed; and

[0063] In the host processor, after the at least one emergency command has been executed, the cleanup operation is resumed in the UFS device.

[0064] 2. The method according to Clause 1, further comprising:

[0065] In the host processor, if one or more new commands, other than the at least one emergency command, arrive at the CQ after the clearing operation is interrupted and before the restored clearing operation has been completed, the execution of the one or more new commands is delayed until the restored clearing operation has been completed.

[0066] 3. The method according to Clause 2, wherein the host processor delays the execution of the one or more new commands by storing the one or more new commands in a wait queue (WaitQ) until the restored cleanup operation has been completed.

[0067] 4. The method according to Clause 3, further comprising:

[0068] In the host processor, after the restored cleanup operation has been completed, the one or more new commands are moved from the WaitQ to the CQ; and

[0069] In the host processor, the one or more new commands are retrieved from the CQ and the one or more retrieved new commands are executed.

[0070] 5. The method according to any one of clauses 1 to 4, wherein the method further comprises:

[0071] In the host processor, before interrupting the cleanup operation, a command is sent to the UFS device to release the assertion of the cleanup enable flag, wherein the release assertion of the cleanup enable flag causes the UFS device to interrupt the cleanup operation.

[0072] 6. The method according to any one of Clauses 1 to 5, wherein the UFS device notifies the host processor that the cleanup operation has been interrupted by setting a cleanup status attribute to a first value indicating that the cleanup operation has been interrupted and sending the first cleanup status attribute value to the host processor to notify the host processor that the cleanup operation has been interrupted.

[0073] 7. The method according to any one of Clauses 5 to 6, wherein after the at least one emergency command has been executed, the host processor causes the clearing operation to be resumed in the UFS device by sending a command to the UFS device to re-assert the clear enable flag, wherein the re-assertion of the clear enable flag causes the UFS device to resume the clearing operation.

[0074] 8. The method according to any one of clauses 6 to 7, wherein the method further comprises:

[0075] In the UFS device, after the recovery operation has been completed, the clearing status attribute is set to a second value indicating that the recovery clearing operation has been completed, and the second clearing status attribute value is sent to the host processor to notify the host processor that the recovery clearing operation has been completed.

[0076] 9. The method according to Clause 8, further comprising:

[0077] In the host processor, after receiving the second clearing status attribute value indicating that the clearing operation has been completed, the one or more new commands are moved from the WaitQ to the CQ, the one or more new commands are retrieved from the CQ, and the one or more retrieved new commands are executed.

[0078] 10. The method according to any one of clauses 1 to 9, wherein the host processor and the UFS device are components of a portable computing device.

[0079] 11. A system for enhancing the security of a Universal Flash Storage (UFS) device during a wipe operation aimed at deleting data stored in one or more physical blocks of flash memory of the UFS device, the system comprising:

[0080] The UFS device includes a control logic component configured to output a notification that the clearing operation has been interrupted due to the issuance of at least one emergency command.

[0081] A host processor, the host processor including a processing logic unit, the processing logic unit being configured to:

[0082] Receive the notification;

[0083] The at least one emergency command is stored in the command queue (CQ) of the host processor;

[0084] Execute at least one of the emergency commands; and

[0085] After at least one emergency command has been executed, the cleanup operation is resumed in the UFS device.

[0086] 12. The system according to Clause 11, wherein the processing logic component of the host processor is further configured to:

[0087] If one or more new commands, other than the at least one emergency command, arrive at the CQ after the clearing operation is interrupted and before the restored clearing operation is completed, the execution of the one or more new commands is delayed until the restored clearing operation is completed.

[0088] 13. The system according to Clause 12, wherein the processing logic component of the host processor delays the execution of the one or more new commands by storing the one or more new commands in a wait queue (WaitQ) until the restored cleanup operation has been completed.

[0089] 14. The system according to Clause 13, wherein the processing logic component of the host processor is further configured to:

[0090] After the recovery and cleanup operation has been completed, move the one or more new commands from the WaitQ to the CQ;

[0091] Retrieve the one or more new commands from the CQ; and

[0092] Execute one or more of the retrieved new commands.

[0093] 15. The system according to any one of clauses 11 to 14, wherein the processing logic component of the host processor is further configured to:

[0094] Before interrupting the cleanup operation, a command to cancel the assertion to clear the enable flag is sent to the UFS device, wherein the cancel assertion to clear the enable flag causes the UFS device to interrupt the cleanup operation.

[0095] 16. The system according to any one of Clauses 11 to 15, wherein the control logic component of the UFS device is configured to output a notification that the clearing operation has been interrupted to the host processor by setting a clearing status attribute to a first value indicating that the clearing operation has been interrupted and by sending the first clearing status attribute value to the host processor to notify the host processor that the clearing operation has been interrupted.

[0096] 17. A system according to any one of clauses 15 to 16, wherein the processing logic component of the host processor is configured to cause the clearing operation to be resumed in the UFS device by sending a command to the UFS device to reassert the clearing enable flag, wherein the reassertion of the clearing enable flag causes the UFS device to resume the clearing operation.

[0097] 18. The system according to any one of Clauses 16 to 17, wherein the control logic component of the UFS device is further configured to:

[0098] After the restored clearing operation has been completed, the clearing status attribute is set to a second value indicating that the restored clearing operation has been completed; and

[0099] The second clearing status attribute value is sent to the host processor to notify the host processor that the clearing operation that was restored has been completed.

[0100] 19. The system according to Clause 18, wherein the processing logic component of the host processor is further configured to:

[0101] After receiving the second clearing status attribute value indicating that the clearing operation has been completed, the one or more new commands are moved from the WaitQ to the CQ, the one or more new commands are retrieved from the CQ, and the one or more retrieved new commands are executed.

[0102] 20. The system according to any one of Clauses 11 to 19, wherein the host processor and the UFS device are components of a portable computing device.

[0103] 21. A computer program embodied on a non-transitory, non-transitory computer-readable medium for execution by a processor to improve the security of a Universal Flash Storage (UFS) device during a wipe operation aimed at deleting data stored in one or more physical blocks of flash memory of the UFS device, the computer program comprising:

[0104] A first computer instruction set, executed by the control logic unit of the UFS device, to output a notification that the clearing operation has been interrupted due to the issuance of at least one emergency command; and

[0105] A second computer instruction set, which is executed by the processing logic unit of the host processor for:

[0106] Receive the notification;

[0107] The at least one emergency command is stored in the command queue (CQ) of the host processor;

[0108] Execute at least one of the emergency commands; and

[0109] After at least one emergency command has been executed, the cleanup operation is resumed in the UFS device.

[0110] 22. The computer program according to Clause 21, further comprising a third computer instruction set, the third computer instruction set being executed by the processing logic unit of the host processor to:

[0111] If one or more new commands, other than the at least one emergency command, arrive at the CQ after the clearing operation is interrupted and before the restored clearing operation is completed, the execution of the one or more new commands is delayed until the restored clearing operation is completed.

[0112] 23. The computer program pursuant to Clause 22, wherein the third computer instruction set delays the execution of the one or more new commands by storing the one or more new commands in a wait queue (WaitQ) until the restored cleanup operation has been completed.

[0113] 24. The computer program according to any one of clauses 22 to 23, further comprising a fourth computer instruction set, the fourth computer instruction set being executed by the processing logic unit of the host processor for:

[0114] After the recovery and cleanup operation has been completed, move the one or more new commands from the WaitQ to the CQ;

[0115] Retrieve the one or more new commands from the CQ; and

[0116] Execute one or more of the retrieved new commands.

[0117] 25. The computer program according to Clause 24, further comprising a fifth computer instruction set, the fifth computer instruction set being executed by the processing logic unit of the host processor to:

[0118] Before interrupting the cleanup operation, a command to cancel the assertion to clear the enable flag is sent to the UFS device, wherein the cancel assertion to clear the enable flag causes the UFS device to interrupt the cleanup operation.

[0119] 26. The computer program according to any one of clauses 21 to 25, wherein the first set of computer instructions for execution by the control logic unit of the UFS device outputs the notification that the clearing operation has been interrupted to the host processor by setting a clearing status attribute to a first value indicating that the clearing operation has been interrupted and by sending the first clearing status attribute value to the host processor to notify the host processor that the clearing operation has been interrupted.

[0120] 27. A computer program according to any one of clauses 21 to 26, wherein the second set of computer instructions causes the clearing operation to be resumed in the UFS device by sending a command to the UFS device to re-assert the clear enable flag, wherein the re-assertion of the clear enable flag causes the UFS device to resume the clearing operation.

[0121] 28. The computer program according to any one of clauses 25 to 27, the computer program further comprising a sixth computer instruction set, the sixth computer instruction set being executed by the control logic unit of the UFS device to:

[0122] After the second computer instruction set has been completed and the restored clearing operation has been completed, the clearing status attribute is set to a second value indicating that the restored clearing operation has been completed; and

[0123] The second clearing status attribute value is sent to the host processor to notify the host processor that the clearing operation that was restored has been completed.

[0124] 29. The computer program according to Clause 28, further comprising a seventh computer instruction set, the seventh computer instruction set being executed by the processing logic unit of the host processor to:

[0125] The second clearing status attribute value indicating that the restored clearing operation has been completed; and

[0126] After receiving the second clearing status attribute value indicating that the clearing operation has been completed, the one or more new commands are moved from the WaitQ to the CQ, the one or more new commands are retrieved from the CQ, and the one or more retrieved new commands are executed.

[0127] 30. A system for enhancing the security of a Universal Flash Storage (UFS) device during a wipe operation aimed at deleting data stored in one or more physical blocks of flash memory of the UFS device, the system comprising:

[0128] A component for outputting a notification from the UFS device that the cleanup operation has been interrupted due to the issuance of at least one emergency order;

[0129] Components for receiving the notification in the host processor;

[0130] Components for storing the at least one emergency command in the command queue (CQ) of the host processor;

[0131] Components for executing the at least one emergency command in the host processor; and

[0132] A component for resuming the cleanup operation in the UFS device after at least one emergency command has been executed.

[0133] In view of this disclosure, alternative embodiments will become apparent to those skilled in the art to which this invention pertains. Therefore, although alternative aspects have been illustrated and described in detail, it should be understood that various substitutions and changes may be made therein.

Claims

1. A method for enhancing the security of a Universal Flash Storage (UFS) device during a wipe operation aimed at deleting data stored in one or more physical blocks of flash memory of the UFS device, the method comprising: In the UFS device, if the cleanup operation in the UFS device is interrupted due to the issuance of at least one emergency command, a message notifying the host processor that the cleanup operation has been interrupted is sent. In the host processor, the message is stored in one of a plurality of registers, and the at least one emergency command is stored in a command queue (CQ) that is part of the host processor. When the clearing operation in the UFS device is interrupted and before the clearing operation is resumed, and one or more new commands other than the at least one emergency command arrive at the CQ, the host processor stores the one or more new commands in the wait queue WaitQ, which is part of the host processor. The host processor executes the at least one emergency command; In the host processor, after the at least one emergency command has been executed, the cleanup operation is resumed in the UFS device; After the recovery and cleanup operation has been completed, the host processor moves the one or more new commands from the WaitQ to the CQ; and The host processor executes the one or more new commands.

2. The method according to claim 1, further comprising: In the host processor, if one or more new commands, other than the at least one emergency command, arrive at the CQ after the clearing operation is interrupted and before the restored clearing operation has been completed, the execution of the one or more new commands stored in the waiting queue is delayed until the restored clearing operation has been completed.

3. The method of claim 2, wherein the host processor delays the execution of the one or more new commands by storing the one or more new commands in the wait queue WaitQ until the restored cleanup operation has been completed.

4. The method according to claim 3, further comprising: In the host processor, before interrupting the cleanup operation, a command is sent to the UFS device to release the assertion of the cleanup enable flag, wherein the release assertion of the cleanup enable flag causes the UFS device to interrupt the cleanup operation.

5. The method of claim 4, wherein the UFS device notifies the host processor that the cleanup operation has been interrupted by setting a cleanup status attribute to a first value indicating that the cleanup operation has been interrupted and sending the first cleanup status attribute value as part of the message to the host processor to notify the host processor that the cleanup operation has been interrupted.

6. The method of claim 5, wherein after the at least one emergency command has been executed, the host processor causes the clearing operation to be resumed in the UFS device by sending a command to the UFS device to re-assert the clear enable flag, wherein the re-assertion of the clear enable flag causes the UFS device to resume the clearing operation.

7. The method according to claim 6, further comprising: In the UFS device, after the recovery operation has been completed, the clearing status attribute is set to a second value indicating that the recovery clearing operation has been completed, and the second clearing status attribute value is sent to the host processor to notify the host processor that the recovery clearing operation has been completed.

8. The method according to claim 7, further comprising: In the host processor, after receiving the second clearing status attribute value indicating that the clearing operation has been completed, the one or more new commands are moved from the WaitQ to the CQ, the one or more new commands are retrieved from the CQ, and the one or more retrieved new commands are executed.

9. The method of claim 1, wherein the host processor and the UFS device are components of a portable computing device.

10. A system for enhancing the security of a Universal Flash Storage (UFS) device during a wipe operation aimed at deleting data stored in one or more physical blocks of flash memory of the UFS device, the system comprising: The UFS device includes a control logic component configured to output a notification that the clearing operation has been interrupted due to the issuance of at least one emergency command. A host processor, comprising a command queue, a wait queue, multiple registers, and a processing logic unit configured to: Receive the notification and store the notification in one of the plurality of registers; The at least one emergency command is stored in the command queue CQ of the host processor; When one or more new commands, other than the at least one emergency command, arrive at the CQ after the clearing operation is interrupted and before the clearing operation is resumed, the one or more new commands are stored in the waiting queue WaitQ. Execute at least one of the emergency commands; After at least one emergency command has been executed, the cleanup operation is resumed in the UFS device; After the recovery and cleanup operation has been completed, move the one or more new commands from the WaitQ to the CQ; and The host processor is used to execute the one or more new commands.

11. The system of claim 10, wherein the processing logic component of the host processor is further configured to: Before interrupting the cleanup operation, a command to cancel the assertion to clear the enable flag is sent to the UFS device, wherein the cancel assertion to clear the enable flag causes the UFS device to interrupt the cleanup operation.

12. The system of claim 11, wherein the control logic component of the UFS device is configured to output a notification that the clearing operation has been interrupted to the host processor by setting a clearing status attribute to a first value indicating that the clearing operation has been interrupted and by sending the first clearing status attribute value to the host processor to notify the host processor that the clearing operation has been interrupted.

13. The system of claim 12, wherein the processing logic component of the host processor is configured to cause the clearing operation to be resumed in the UFS device by sending a command to the UFS device to re-assert the clear enable flag, wherein the re-assertion of the clear enable flag causes the UFS device to resume the clearing operation.

14. The system of claim 13, wherein the control logic component of the UFS device is further configured to: After the restored clearing operation has been completed, the clearing status attribute is set to a second value indicating that the restored clearing operation has been completed; and The second clearing status attribute value is sent to the host processor to notify the host processor that the clearing operation that was restored has been completed.

15. The system of claim 14, wherein the processing logic component of the host processor is further configured to: In response to receiving a second clearing status attribute value indicating that the restored clearing operation has been completed, the one or more new commands are moved from the WaitQ to the CQ.

16. The system of claim 10, wherein the host processor and the UFS device are components of a portable computing device.

17. A computer program embodied on a non-transitory computer-readable medium for execution by a processor to improve the security of a Universal Flash Storage (UFS) device during a wipe operation aimed at deleting data stored in one or more physical blocks of flash memory of the UFS device, the computer program comprising: A first computer instruction set, which is executed by the control logic unit of the UFS device to output a notification that the clearing operation has been interrupted due to the issuance of at least one emergency command; as well as A second computer instruction set, which is executed by the processing logic unit of a host processor, the host processor including a command queue, a wait queue, and multiple registers, the second computer instruction set including: Receive the notification and store the notification in one of the plurality of registers; The at least one emergency command is stored in the command queue CQ of the host processor; When one or more new commands, other than the at least one emergency command, arrive at the CQ after the clearing operation is interrupted and before the clearing operation is resumed, the one or more new commands are stored in the waiting queue WaitQ. Execute at least one of the emergency commands; After at least one emergency command has been executed, the cleanup operation is resumed in the UFS device; After the recovery and cleanup operation has been completed, move the one or more new commands from the WaitQ to the CQ; and The host processor is used to execute the one or more new commands.

18. The computer program of claim 17, further comprising a third computer instruction set, the third computer instruction set being executed by the processing logic unit of the host processor to: When one or more new commands, other than the at least one emergency command, arrive at the CQ after the clearing operation is interrupted and before the restored clearing operation is completed, the execution of the one or more new commands is delayed until the restored clearing operation is completed.

19. The computer program of claim 18, wherein the third computer instruction set delays the execution of the one or more new commands by storing the one or more new commands in the wait queue WaitQ until the restored clearing operation has been completed.

20. The computer program of claim 19, further comprising a fourth computer instruction set, the fourth computer instruction set being executed by the processing logic unit of the host processor to: Before interrupting the cleanup operation, a command to cancel the assertion to clear the enable flag is sent to the UFS device, wherein the cancel assertion to clear the enable flag causes the UFS device to interrupt the cleanup operation.

21. The computer program of claim 20, wherein the first set of computer instructions for execution by the control logic unit of the UFS device outputs the notification that the clearing operation has been interrupted to the host processor by setting a clearing status attribute to a first value indicating that the clearing operation has been interrupted and by sending the first clearing status attribute value to the host processor to notify the host processor that the clearing operation has been interrupted.

22. The computer program of claim 21, wherein the second set of computer instructions causes the clearing operation to be resumed in the UFS device by sending a command to the UFS device to re-assert the clear enable flag, wherein the re-assertion of the clear enable flag causes the UFS device to resume the clearing operation.

23. The computer program of claim 22, further comprising a fifth computer instruction set, the fifth computer instruction set being executed by the control logic unit of the UFS device to: After the second computer instruction set has been completed and the restored clearing operation has been completed, the clearing status attribute is set to a second value indicating that the restored clearing operation has been completed; and The second clearing status attribute value is sent to the host processor to notify the host processor that the clearing operation that was restored has been completed.

24. The computer program of claim 23, further comprising a sixth computer instruction set, the sixth computer instruction set being executed by the processing logic unit of the host processor to: The second clearing status attribute value indicating that the restored clearing operation has been completed; and In response to receiving a second clearing status attribute value indicating that the restored clearing operation has been completed, the one or more new commands are moved from the WaitQ to the CQ.

Images