Using trusted platform module (TPM) emulator engines to measure firmware images

A system comprising:

• a processor;
• and
• a memory to store firmware instructions that, when executed by the processor, cause the processor to:
• emulate a Trusted Platform Module (TPM), wherein emulating the TPM comprises determining a measurement of the firmware image beginning from a hardware root of trust boot block prior to booting of the system, storing the measurement of the firmware image in a virtual Platform Configuration Register (PCR), and continuing the measurement along a chain of trust based on the hardware root of trust boot block during boot of the system;
• retrieve a pre-determined measurement of the firmware image from a whitelisted database;
• compare the measurement of the firmware image with the pre-determined measurement of the firmware image prior to booting of the system;
• and
• perform an action, in response to a determination that the measurement of the firmware image is different from the pre-determined measurement of the firmware image.

A non-transitory machine-readable storage medium comprising instructions, the instructions executable by a processor to:

• receive, at a firmware component in a system without a hardware-based Trusted Platform Module (TPM), a request to attest a firmware image;
• generate, at the firmware component, a hash of the firmware image, prior to boot of the system, wherein the hash is generated, beginning from a hardware root of trust boot block, by a TPM emulator engine that emulates a hardware-based TPM;
• retrieve, at the firmware component, a pre-determined measurement of the firmware image from a storage location external to the system;
• compare, at the firmware component, the measurement of the firmware image with the pre-determined measurement of the firmware image prior to boot of the system;
• perform an action, in response to a determination that the measurement of the firmware image is different from the pre-determined measurement of the firmware image;
• and
• continue the measurement along a chain of trust based on the hardware root of trust boot block during boot of the system.