pi-reference-tag · shipping · also Protection-information reference tag, Logical block reference tag

PI reference tag

A protection-information reference tag carries address-related information whose checking depends on the selected protection type and format.

Related Observatory article: PI reference tag on hesela.com

Linux v6.12's t10_pi_tuple uses a 32-bit reference field for a target or indirect logical-block address; its Type 3 description does not define a reference-address check. Do not assume every PI tuple validates location. [1]

NVM Command Set 1.0e distinguishes protection type from field layout and permits configurable storage/reference allocation. A reference field need not have the width of the host address. [2]

Hesela inference: matching an address-related tag does not prove freshness. A previously valid data/tag pair can still represent an older version unless another mechanism checks the expected generation. This is a limit of the information supplied to the checker, not evidence of a device vulnerability. [1]

Relations

related

Protection information (PI), PI guard tag, PI application tag, Logical block address, Misdirected write, Lost write

Citations

1. Linux v6.12: T10 PI tuple and protection-type comments (GPL-2.0) (accessed 2026-11-05)
2. NVM Express NVM Command Set Specification 1.0e, sections 5.2.1 and 5.2.3, pp. 78-84 and 94-95; copyright 2008 to 2024 NVM Express, Inc. ALL RIGHTS RESERVED. (accessed 2026-11-05)

Further reading

3. Linux v6.12 Data Integrity documentation, sections 2 and 3 (historical design context) (accessed 2026-11-05)

JSON: /data/terms/pi-reference-tag.json