Gate SPDM channel return codes by spec or feature

ChangeLog.md

@@ -1,5 +1,11 @@
 # Release Notes
 
+## Unreleased
+
+* Added SPDM transport-bound TPM policies (PR #594).
+  - Added `TPM2_PolicyTransportSPDM` client support and fwTPM enforcement.
+  - Added SPDM-bound NV policy examples and tests.
+
 ## wolfTPM Release 4.2.0 (Sep 14, 2026)
 
 **Summary**

src/tpm2.c

@@ -7278,8 +7278,10 @@ const char* TPM2_GetRCString(int rc)
             TPM_RC_STR(TPM_RC_BINDING,           "Public and sensitive portions of an object are not cryptographically bound");
             TPM_RC_STR(TPM_RC_CURVE,             "Curve not supported");
             TPM_RC_STR(TPM_RC_ECC_POINT,         "Point is not on the required curve");
+        #if defined(WOLFTPM_V185) || defined(WOLFTPM_SPDM)
             TPM_RC_STR(TPM_RC_CHANNEL,           "Command is not protected by a secure channel required by the policy");
             TPM_RC_STR(TPM_RC_CHANNEL_KEY,       "Secure channel key does not match the key required by the policy");
+        #endif
         default:
             break;
         }

wolftpm/tpm2.h

@@ -424,13 +424,16 @@ typedef enum {
 #endif
     /* TCG Part 2 Sec.6.6.3 Table 17 -- present since v1.16, not v1.85 */
     TPM_RC_PARMS              = RC_FMT1 + 0x02A,
-    TPM_RC_CHANNEL            = RC_FMT1 + 0x030,
-    TPM_RC_CHANNEL_KEY        = RC_FMT1 + 0x031,
 #ifdef WOLFTPM_PQC
     /* v185 rc4 Part 2 Sec.6.6.3 Table 17 additions */
     TPM_RC_EXT_MU             = RC_FMT1 + 0x02B,
     TPM_RC_ONE_SHOT_SIGNATURE = RC_FMT1 + 0x02C,
     TPM_RC_SIGN_CONTEXT_KEY   = RC_FMT1 + 0x02D,
+#endif
+#if defined(WOLFTPM_V185) || defined(WOLFTPM_SPDM)
+    /* Part 2 v1.85 Sec.6.6.3 Table 17 channel protocol codes */
+    TPM_RC_CHANNEL            = RC_FMT1 + 0x030,
+    TPM_RC_CHANNEL_KEY        = RC_FMT1 + 0x031,
 #endif
     RC_MAX_FMT1             = RC_FMT1 + 0x03F,