Make TPM_RC_RETRY auto-resubmit opt-in (default 0) per review

ChangeLog.md

@@ -27,13 +27,14 @@
   client wrappers, DA/noDA/lockout/self-heal/persistence unit tests, an
   `examples/management/da_check` end-to-end example, and the
   `tests/fwtpm_da_retry.sh` CI harness.
-* Added transparent `TPM_RC_RETRY` handling so commands are automatically
-  resubmitted when the TPM reports it is momentarily busy (for example
-  persisting the daUsed flag on first auth use of a non-noDA AIK/SUDI key),
-  matching the TCG ESYS behavior. Resubmit count defaults to `WOLFTPM_MAX_RETRIES`
-  (3) and is configurable at runtime via `TPM2_SetCommandRetries`; define
-  `WOLFTPM_NO_RETRY` or set the count to 0 to disable and return `TPM_RC_RETRY`
-  to the caller.
+* Added optional transparent `TPM_RC_RETRY` handling so commands can be
+  automatically resubmitted when the TPM reports it is momentarily busy (for
+  example persisting the daUsed flag on first auth use of an externally
+  provisioned non-noDA AIK/SUDI key). Disabled by default to preserve the raw
+  TPM response code; opt in via `TPM2_SetCommandRetries` at runtime or
+  `-DWOLFTPM_MAX_RETRIES=N` at build time. Define `WOLFTPM_NO_RETRY` to compile
+  the handling out entirely. wolfTPM's own key templates set `noDA` and never
+  trigger it.
 
 ## wolfTPM Release 4.0.0 (Apr 22, 2026)
 

README.md

@@ -363,8 +363,8 @@ WOLFTPM2_USE_SW_ECDHE   Disables use of TPM for ECC ephemeral key generation and
 WOLFTPM2_ECC_DEFAULT_CURVE  Default ECC curve for wrapper key templates that request P256 (SRK/AIK/general ECC). Defaults to TPM_ECC_NIST_P256, or the smallest enabled curve meeting ECC_MIN_KEY_SZ. Override e.g. -DWOLFTPM2_ECC_DEFAULT_CURVE=TPM_ECC_NIST_P384.
 TLS_BENCH_MODE          Enables TLS benchmarking mode.
 NO_TPM_BENCH            Disables the TPM benchmarking example.
-WOLFTPM_MAX_RETRIES     Number of times a command is transparently resubmitted when the TPM returns TPM_RC_RETRY (momentarily busy, e.g. persisting the daUsed flag on first auth use of a non-noDA AIK/SUDI key). Defaults to 3. Adjust at runtime with TPM2_SetCommandRetries().
-WOLFTPM_NO_RETRY        Compiles out the TPM_RC_RETRY auto-resubmit handling; TPM_RC_RETRY is returned to the caller for manual handling.
+WOLFTPM_MAX_RETRIES     Default number of times a command is transparently resubmitted when the TPM returns TPM_RC_RETRY (momentarily busy, e.g. persisting the daUsed flag on first auth use of an externally provisioned non-noDA AIK/SUDI key). Disabled by default (0); opt in with TPM2_SetCommandRetries() at runtime or -DWOLFTPM_MAX_RETRIES=N at build time. wolfTPM's own key templates set noDA and never trigger it.
+WOLFTPM_NO_RETRY        Compiles out the TPM_RC_RETRY auto-resubmit handling entirely; TPM_RC_RETRY is returned to the caller for manual handling.
 ```
 
 Note: For the I2C support on Raspberry Pi you may need to enable I2C. Here are the steps:

wolftpm/tpm2.h

@@ -3782,7 +3782,7 @@ WOLFTPM_API TPM_RC TPM2_SetHalIoCb(TPM2_CTX* ctx, TPM2HalIoCb ioCb, void* userCt
 /*!
     \ingroup TPM2_Proprietary
     \brief Sets the number of times a command is transparently resubmitted on TPM_RC_RETRY
-    \brief The TPM returns TPM_RC_RETRY when momentarily busy (for example persisting the daUsed flag on first auth use of a non-noDA key). Defaults to WOLFTPM_MAX_RETRIES; set to 0 to disable and have TPM_RC_RETRY returned to the caller.
+    \brief The TPM returns TPM_RC_RETRY when momentarily busy (for example persisting the daUsed flag on first auth use of a non-noDA key). Disabled by default (WOLFTPM_MAX_RETRIES is 0); pass a count > 0 to enable transparent resubmit. A count of 0 returns TPM_RC_RETRY to the caller.
 
     \return TPM_RC_SUCCESS: successful
     \return BAD_FUNC_ARG: the TPM2 context is NULL or retries is negative

wolftpm/tpm2_types.h

@@ -571,16 +571,18 @@ typedef int64_t  INT64;
 #define TPM_SPI_WAIT_RETRY 50
 #endif
 
-/* Number of times to transparently resubmit a command on TPM_RC_RETRY.
+/* Default number of times to transparently resubmit a command on TPM_RC_RETRY.
  * The TPM returns TPM_RC_RETRY when momentarily busy (e.g. persisting the
- * daUsed flag on first auth use of a non-noDA key). Set to 0, or define
- * WOLFTPM_NO_RETRY, to disable and pass TPM_RC_RETRY back to the caller. */
+ * daUsed flag on first auth use of a non-noDA key). Disabled by default (0) to
+ * keep the raw TPM response code; opt in at runtime with TPM2_SetCommandRetries
+ * or at build time with -DWOLFTPM_MAX_RETRIES=N. Define WOLFTPM_NO_RETRY to
+ * compile the handling out entirely. */
 #ifdef WOLFTPM_NO_RETRY
     #undef  WOLFTPM_MAX_RETRIES
     #define WOLFTPM_MAX_RETRIES 0
 #endif
 #ifndef WOLFTPM_MAX_RETRIES
-#define WOLFTPM_MAX_RETRIES 3
+#define WOLFTPM_MAX_RETRIES 0
 #endif
 
 #ifndef MAX_SYM_BLOCK_SIZE