Re: [PATCH 3/4] tools/libxl: add emulated TPM support backed by swtpm

[Nick Rosbrook <enr0n@xxxxxxxxxx>]

On Fri, Nov 6, 2026 at 6:15 PM Jason Andryuk <jason.andryuk@xxxxxxx> wrote:
>
> Add support for an emulated TPM.  QEMU emulates the device and uses
> swtpm for the backend.  swtpm is started first and QEMU connects to it.
>
> Add the xl.cfg options are:
> tpm_version
> tpm_statedir
> tpm_statefile
> tpm_interface
> tpm_loglevel
> tpm_swtpm_override
>
> When tpm_version is absent, no TPM is configured.  tpm_version must be 1
> or 2, and exactly one of tpm_statedir or tpm_statefile must be
> specified.  tpm_statefile is only supported for swtpm 0.7 and later, so
> tpm_statedir is provided for compatiblity.  tpm_interface can be either
> tis or crb.  tpm_loglevel is passed to swtpm when non-zero, with swtpm
> logging to /var/log/xen/swtpm-<domain>.log.  tpm_swtpm_override specifies
> the swtpm executable path; otherwise swtpm is found via PATH.
>
> On x86, TPM 1.2 only supports TIS, while TPM 2.0 may use either and
> defaults to CRB.
>
> libxl typically tracks spawned daemons through xenstore keys - like QEMU
> writing its "state" key as "running".  swtpm does not write to
> xenstores, so that is not used.  Instead the daemon is launched first
> and then QEMU launches and connects to it.  If there is a failure,
> the QEMU log messages will list tpm in the error message.
>
> `interface` is a Go keyword, so the binding generator needs to specify
> that.
>

For the tools/golang changes:

Acked-by: Nick Rosbrook <enr0n@xxxxxxxxxx>