As per the NVM command set specification, the protection information
checks for Type 3 protection are disabled, only when both application
and reference tag have all bits set to 1.

Signed-off-by: Ankit Kumar <ankit.kumar@samsung.com>
---
 hw/nvme/dif.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/nvme/dif.c b/hw/nvme/dif.c
index 01b19c3373..f9bd29a2a6 100644
--- a/hw/nvme/dif.c
+++ b/hw/nvme/dif.c
@@ -157,7 +157,8 @@ static uint16_t nvme_dif_prchk_crc16(NvmeNamespace *ns, NvmeDifTuple *dif,
 {
     switch (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
     case NVME_ID_NS_DPS_TYPE_3:
-        if (be32_to_cpu(dif->g16.reftag) != 0xffffffff) {
+        if ((be32_to_cpu(dif->g16.reftag) != 0xffffffff) ||
+            (be16_to_cpu(dif->g16.apptag) != 0xffff)) {
             break;
         }
 
@@ -225,7 +226,7 @@ static uint16_t nvme_dif_prchk_crc64(NvmeNamespace *ns, NvmeDifTuple *dif,
 
     switch (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
     case NVME_ID_NS_DPS_TYPE_3:
-        if (r != 0xffffffffffff) {
+        if (r != 0xffffffffffff || (be16_to_cpu(dif->g64.apptag) != 0xffff)) {
             break;
         }
 
-- 
2.25.1

On Aug  8 02:57, Ankit Kumar wrote:
> As per the NVM command set specification, the protection information
> checks for Type 3 protection are disabled, only when both application
> and reference tag have all bits set to 1.
> 
> Signed-off-by: Ankit Kumar <ankit.kumar@samsung.com>
> ---
>  hw/nvme/dif.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/nvme/dif.c b/hw/nvme/dif.c
> index 01b19c3373..f9bd29a2a6 100644
> --- a/hw/nvme/dif.c
> +++ b/hw/nvme/dif.c
> @@ -157,7 +157,8 @@ static uint16_t nvme_dif_prchk_crc16(NvmeNamespace *ns, NvmeDifTuple *dif,
>  {
>      switch (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
>      case NVME_ID_NS_DPS_TYPE_3:
> -        if (be32_to_cpu(dif->g16.reftag) != 0xffffffff) {
> +        if ((be32_to_cpu(dif->g16.reftag) != 0xffffffff) ||
> +            (be16_to_cpu(dif->g16.apptag) != 0xffff)) {
>              break;
>          }

For type 3, if reftag is 0xffffffff the NVME_ID_NS_DPS_TYPE_3 case will
fallthrough to the next cases (_TYPE_1 and _TYPE_2), checking if apptag
is 0xffff, and disable checking if so. 

>  
> @@ -225,7 +226,7 @@ static uint16_t nvme_dif_prchk_crc64(NvmeNamespace *ns, NvmeDifTuple *dif,
>  
>      switch (NVME_ID_NS_DPS_TYPE(ns->id_ns.dps)) {
>      case NVME_ID_NS_DPS_TYPE_3:
> -        if (r != 0xffffffffffff) {
> +        if (r != 0xffffffffffff || (be16_to_cpu(dif->g64.apptag) != 0xffff)) {
>              break;
>          }

Same here.