Add documentation for the TPM backend profile node and point the reader to
further documentation about TPM profiles available in the swtpm man page.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
---
 docs/formatdomain.rst | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst
index c50744b57b..6539f620fa 100644
--- a/docs/formatdomain.rst
+++ b/docs/formatdomain.rst
@@ -8131,6 +8131,7 @@ Example: usage of the TPM Emulator
            <active_pcr_banks>
                <sha256/>
            </active_pcr_banks>
+           <profile source='local:restricted' remove_disabled='check'/>
          </backend>
        </tpm>
      </devices>
@@ -8225,6 +8226,35 @@ Example: usage of the TPM Emulator
    and may not have any effect otherwise. The selection of PCR banks only works
    with the ``emulator`` backend. :since:`Since 7.10.0`
 
+``profile``
+   The ``profile`` node is used to set a profile for a TPM 2.0 given in the
+   source attribute. This profile will be set when the TPM is initially
+   created and after that cannot be changed anymore. If no profile is provided,
+   then swtpm will use the latest built-in 'default' profile or the default
+   profile set in swtpm_setup.conf. Otherwise swtpm_setup will search for a
+   profile with the given name with appended .json suffix in a configurable
+   local and then in a distro directory. If none could be found in either, it
+   will fall back trying to use a built-in one.
+
+   The built-in 'null' profile provides backwards compatibility with
+   libtpms v0.9 but also restricts the user to use only TPM features that were
+   available at the time of libtpms v0.9. The built-in 'custom' profile is the
+   only profile that a user can modify and where the ``remove_disabled``
+   attribute has any effect. This attribute is particularly useful when a host
+   is running in FIPS mode and therefore some crypto algorithms (camellia,
+   tdes, unpadded RSA encryption, 1024-bit RSA keys, and others) are
+   disabled. When it is set to ``check`` (recommended) then only those
+   algorithms that are currently disabled will automatically be removed from
+   the 'custom' profile, while when it is set to ``fips-host`` then all
+   potentially disabled algorithms will be removed. :since:`Since 10.??.0`
+
+   TPM profiles provided by a distro can be referenced with the 'distro:'
+   prefix. Locally created TPM profiles can be referenced with the
+   'local:' prefix.
+
+   For further information about TPM profiles see the man pages for ``swtpm``
+   (swtpm v0.10).
+
 ``encryption``
    The ``encryption`` element allows the state of a TPM emulator to be
    encrypted. The ``secret`` must reference a secret object that holds the
-- 
2.47.0