Index: root/xen-unstable.hg/tools/python/xen/xm/xenapi_create.py
===================================================================
--- root.orig/xen-unstable.hg/tools/python/xen/xm/xenapi_create.py
+++ root/xen-unstable.hg/tools/python/xen/xm/xenapi_create.py
@@ -265,9 +265,15 @@ class xenapi_create:
             "platform":
                 get_child_nodes_as_dict(vm, "platform", "key", "value"),
             "other_config":
-                get_child_nodes_as_dict(vm, "other_config", "key", "value")
+                get_child_nodes_as_dict(vm, "other_config", "key", "value"),
             }
 
+        if vm.attributes.has_key("security_label"):
+            vm_record.update({
+                "security_label":
+                    vm.attributes["security_label"].value
+                })
+
         if len(vm.getElementsByTagName("pv")) > 0:
             vm_record.update({
                 "PV_bootloader":
@@ -308,6 +314,12 @@ class xenapi_create:
 
             self.create_vifs(vm_ref, vifs)
 
+            # Now create vtpms
+
+            vtpms = vm.getElementsByTagName("vtpm")
+
+            self.create_vtpms(vm_ref, vtpms)
+
             # Now create consoles
 
             consoles = vm.getElementsByTagName("console")
@@ -397,6 +409,21 @@ class xenapi_create:
             self._network_refs = server.xenapi.network.get_all()
             return self._network_refs.pop(0)
 
+    def create_vtpms(self, vm_ref, vtpms):
+        if len(vtpms) > 1:
+            vtpms = [ vtpms[0] ]
+        log(DEBUG, "create_vtpms")
+        return map(lambda vtpm: self.create_vtpm(vm_ref, vtpm), vtpms)
+
+    def create_vtpm(self, vm_ref, vtpm):
+        vtpm_record = {
+            "VM":
+                vm_ref,
+            "backend":
+                vtpm.attributes["backend"].value
+        }
+        return server.xenapi.VTPM.create(vtpm_record)
+
     def create_consoles(self, vm_ref, consoles):
         log(DEBUG, "create_consoles")
         return map(lambda console: self.create_console(vm_ref, console),
@@ -438,6 +465,10 @@ class sxp2xml:
 
         vifs_sxp = map(lambda x: x[1], [device for device in devices
                                         if device[1][0] == "vif"])
+
+        vtpms_sxp = map(lambda x: x[1], [device for device in devices
+                                         if device[1][0] == "vtpm"])
+
         # Create XML Document
         
         impl = getDOMImplementation()
@@ -487,6 +518,14 @@ class sxp2xml:
         vm.attributes["vcpus_at_startup"] \
             = str(get_child_by_name(config, "vcpus", 1))
 
+        sec_data = get_child_by_name(config, "security")
+        if sec_data:
+            try :
+                vm.attributes['security_label'] = \
+                      "sHype:%s:%s" % (sec_data[0][1][1],sec_data[0][2][1])
+            except:
+                raise "Invalid security data format: %s" % str(sec_data)
+
         # Make the name tag
 
         vm.appendChild(self.make_name_tag(
@@ -557,6 +596,12 @@ class sxp2xml:
 
         map(vm.appendChild, vifs)
 
+        # And now the vTPMs
+
+        vtpms = map(lambda vtpm: self.extract_vtpm(vtpm, document), vtpms_sxp)
+
+        map(vm.appendChild, vtpms)
+
         # Last but not least the consoles...
 
         consoles = self.extract_consoles(image, document)
@@ -664,6 +709,14 @@ class sxp2xml:
         
         return vif
 
+    def extract_vtpm(self, vtpm_sxp, document):
+
+        vtpm = document.createElement("vtpm")
+        vtpm.attributes["backend"] \
+             = get_child_by_name(vtpm_sxp, "backend", "0")
+
+        return vtpm
+
     _eths = -1
 
     def mk_other_config(self, key, value, document):
Index: root/xen-unstable.hg/tools/python/xen/xm/create.dtd
===================================================================
--- root.orig/xen-unstable.hg/tools/python/xen/xm/create.dtd
+++ root/xen-unstable.hg/tools/python/xen/xm/create.dtd
@@ -37,6 +37,7 @@
                  memory,
                  vbd*,
                  vif*,
+                 vtpm*,
                  console*,
                  platform*,
                  vcpu_param*,
@@ -73,6 +74,10 @@
                  qos_algorithm_type CDATA    #REQUIRED
                  network         CDATA       #IMPLIED> 
 
+<!ELEMENT vtpm   (name)>
+<!ATTLIST vtpm   %NAMEID;
+                 backend         CDATA #REQUIRED>
+
 <!ELEMENT console (other_config*)>
 <!ATTLIST console protocol       (vt100|rfb|rdp) #REQUIRED>