nvmecontrol: Range-check the format command's field valuesHEADmain

The format command accepted any 32-bit value for -m, -p, -l and
--ses and passed it into the Format NVM command.  Before
eae727676169 an out-of-range value spilled into the adjacent cdw10
fields, which usually drew an error from the controller; after it,
the value is masked to the field width, so a mistyped value is
silently accepted with a different meaning.  Most seriously,
--ses 8 masked to SES=0 and performed a plain format with no erase
at all, exiting 0.  A value like --ses 10 masked to a cryptographic
erase while bypassing the FNA cryptographic erase capability check,
which compares the unmasked value.

Reject values outside the ranges nvmecontrol.8 documents, which are
the values the spec defines: 0-1 for -m and -l, 0-3 for -p, and
0-2 for --ses.  The checks run at option validation time, before
the device is opened, and the capability check now only ever sees
valid values.

While here, document --ses in nvmecontrol.8; it was missing from the
format subcommand's option list.

Reported by:	llm-postcr
Reviewed by:	imp
Fixes:		eae727676169
MFC after:	1 week
Sponsored by:	Spectra Logic
Assisted-by:	Claude Fable 5 <noreply@anthropic.com>
Differential Revision:	https://reviews.freebsd.org/D61406

0 files changed, 0 insertions, 0 deletions