From 3c3dfa92825768d2e7917a4a381e8da2d59961ee Mon Sep 17 00:00:00 2001
From: Aidan Garske <aidan@wolfssl.com>
Date: Tue, 15 Sep 2026 12:34:28 -0700
Subject: [PATCH] Gate SPDM channel return codes by spec or feature

---
 ChangeLog.md   | 6 ++++++
 src/tpm2.c     | 2 ++
 wolftpm/tpm2.h | 7 +++++--
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/ChangeLog.md b/ChangeLog.md
index 4ac76cb5..990e3053 100644
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,11 @@
 # Release Notes
 
+## Unreleased
+
+* Added SPDM transport-bound TPM policies (PR #594).
+  - Added `TPM2_PolicyTransportSPDM` client support and fwTPM enforcement.
+  - Added SPDM-bound NV policy examples and tests.
+
 ## wolfTPM Release 4.2.0 (Sep 14, 2026)
 
 **Summary**
diff --git a/src/tpm2.c b/src/tpm2.c
index 662390d1..15312139 100644
--- a/src/tpm2.c
+++ b/src/tpm2.c
@@ -7278,8 +7278,10 @@ const char* TPM2_GetRCString(int rc)
             TPM_RC_STR(TPM_RC_BINDING,           "Public and sensitive portions of an object are not cryptographically bound");
             TPM_RC_STR(TPM_RC_CURVE,             "Curve not supported");
             TPM_RC_STR(TPM_RC_ECC_POINT,         "Point is not on the required curve");
+        #if defined(WOLFTPM_V185) || defined(WOLFTPM_SPDM)
             TPM_RC_STR(TPM_RC_CHANNEL,           "Command is not protected by a secure channel required by the policy");
             TPM_RC_STR(TPM_RC_CHANNEL_KEY,       "Secure channel key does not match the key required by the policy");
+        #endif
         default:
             break;
         }
diff --git a/wolftpm/tpm2.h b/wolftpm/tpm2.h
index ed1bc0cf..77ae060a 100644
--- a/wolftpm/tpm2.h
+++ b/wolftpm/tpm2.h
@@ -424,13 +424,16 @@ typedef enum {
 #endif
     /* TCG Part 2 Sec.6.6.3 Table 17 -- present since v1.16, not v1.85 */
     TPM_RC_PARMS              = RC_FMT1 + 0x02A,
-    TPM_RC_CHANNEL            = RC_FMT1 + 0x030,
-    TPM_RC_CHANNEL_KEY        = RC_FMT1 + 0x031,
 #ifdef WOLFTPM_PQC
     /* v185 rc4 Part 2 Sec.6.6.3 Table 17 additions */
     TPM_RC_EXT_MU             = RC_FMT1 + 0x02B,
     TPM_RC_ONE_SHOT_SIGNATURE = RC_FMT1 + 0x02C,
     TPM_RC_SIGN_CONTEXT_KEY   = RC_FMT1 + 0x02D,
+#endif
+#if defined(WOLFTPM_V185) || defined(WOLFTPM_SPDM)
+    /* Part 2 v1.85 Sec.6.6.3 Table 17 channel protocol codes */
+    TPM_RC_CHANNEL            = RC_FMT1 + 0x030,
+    TPM_RC_CHANNEL_KEY        = RC_FMT1 + 0x031,
 #endif
     RC_MAX_FMT1             = RC_FMT1 + 0x03F,