From 5c6aaac066620ec706e96fbcacdd49b077143d12 Mon Sep 17 00:00:00 2001
From: Krystian Hebel <krystian.hebel@3mdeb.com>
Date: Mon, 15 Aug 2022 22:36:23 +0200
Subject: [PATCH 01/13] cpu/amd/pi: add skeleton for DRTM

Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
---
 payloads/external/.gitignore   |  1 +
 payloads/external/Makefile.mk  | 11 +++++++++++
 payloads/external/skl/Makefile | 20 ++++++++++++++++++++
 src/cpu/amd/pi/Kconfig         |  8 ++++++++
 src/cpu/amd/pi/Makefile.mk     |  2 ++
 src/cpu/amd/pi/skinit.c        |  8 ++++++++
 6 files changed, 50 insertions(+)
 create mode 100644 payloads/external/skl/Makefile
 create mode 100644 src/cpu/amd/pi/skinit.c

diff --git a/payloads/external/.gitignore b/payloads/external/.gitignore
index c9efcffd032..a5f0f6ef598 100644
--- a/payloads/external/.gitignore
+++ b/payloads/external/.gitignore
@@ -10,3 +10,4 @@ Memtest86Plus/memtest86plus/
 iPXE/ipxe/
 skiboot/skiboot
 skiboot/build
+skl/secure-kernel-loader/
diff --git a/payloads/external/Makefile.mk b/payloads/external/Makefile.mk
index 3b8770833de..1868c470eb1 100644
--- a/payloads/external/Makefile.mk
+++ b/payloads/external/Makefile.mk
@@ -578,3 +578,14 @@ doom.wad-file := $(strip $(CONFIG_COREDOOM_WAD_FILE))
 doom.wad-type := raw
 doom.wad-compression := $(CBFS_SECONDARY_PAYLOAD_COMPRESS_FLAG)
 endif
+
+# SKL
+
+payloads/external/skl/secure-kernel-loader/skl.bin:
+	$(MAKE) -C payloads/external/skl CC="$(HOSTCC)"
+
+cbfs-files-$(CONFIG_LAUNCH_DRTM_PAYLOAD) += $(CONFIG_CBFS_PREFIX)/drtm_payload
+$(CONFIG_CBFS_PREFIX)/drtm_payload-file := payloads/external/skl/secure-kernel-loader/skl.bin
+$(CONFIG_CBFS_PREFIX)/drtm_payload-type := raw
+$(CONFIG_CBFS_PREFIX)/drtm_payload-compression := $(CBFS_PAYLOAD_COMPRESS_FLAG)
+$(CONFIG_CBFS_PREFIX)/drtm_payload-options := $(ADDITIONAL_PAYLOAD_CONFIG)
diff --git a/payloads/external/skl/Makefile b/payloads/external/skl/Makefile
new file mode 100644
index 00000000000..2ae018fbd6d
--- /dev/null
+++ b/payloads/external/skl/Makefile
@@ -0,0 +1,20 @@
+## SPDX-License-Identifier: GPL-2.0-only
+project_git_repo=https://github.com/TrenchBoot/secure-kernel-loader.git
+project_dir=secure-kernel-loader
+
+all: skl
+
+checkout:
+	test -d $(project_dir) || \
+	    git clone $(project_git_repo) $(project_dir)
+
+skl: checkout
+	$(MAKE) -C $(project_dir) DEBUG=y
+
+clean:
+	test -d $(project_dir) && $(MAKE) -C $(project_dir) clean || exit 0
+
+distclean:
+	rm -rf $(project_dir)
+
+.PHONY: checkout skl clean distclean
diff --git a/src/cpu/amd/pi/Kconfig b/src/cpu/amd/pi/Kconfig
index b27bfd1a28d..6db795c8fae 100644
--- a/src/cpu/amd/pi/Kconfig
+++ b/src/cpu/amd/pi/Kconfig
@@ -48,6 +48,14 @@ config SMM_TSEG_SIZE
 	default 0x100000 if HAVE_SMI_HANDLER
 	default 0x0
 
+config LAUNCH_DRTM_PAYLOAD
+	bool "Launch DRTM payload before the real one"
+	default n
+	depends on MEMORY_MAPPED_TPM
+	help
+	  Launch DRTM payload before the real one. This makes it possible to
+	  put root of trust in hardware for platforms that don't support SRTM.
+
 endif # CPU_AMD_PI
 
 source "src/cpu/amd/pi/00730F01/Kconfig"
diff --git a/src/cpu/amd/pi/Makefile.mk b/src/cpu/amd/pi/Makefile.mk
index 104f99bc30c..1e660e0ee0d 100644
--- a/src/cpu/amd/pi/Makefile.mk
+++ b/src/cpu/amd/pi/Makefile.mk
@@ -7,4 +7,6 @@ postcar-y += ../../../soc/amd/common/block/cpu/smm/smm_helper.c
 ramstage-y += ../../../soc/amd/common/block/cpu/smm/smm_helper.c
 ramstage-y += ../../../soc/amd/common/block/cpu/smm/smm_relocate.c
 
+ramstage-$(CONFIG_LAUNCH_DRTM_PAYLOAD) += skinit.c
+
 CPPFLAGS_common += -I$(src)/cpu/amd/pi/include
diff --git a/src/cpu/amd/pi/skinit.c b/src/cpu/amd/pi/skinit.c
new file mode 100644
index 00000000000..976d6abe2fd
--- /dev/null
+++ b/src/cpu/amd/pi/skinit.c
@@ -0,0 +1,8 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#include <program_loading.h>
+
+void platform_prog_run(struct prog *prog)
+{
+	/* do nothing */
+}

From 7097aa7e1c586948a31198c801dede537e5b7dc8 Mon Sep 17 00:00:00 2001
From: Krystian Hebel <krystian.hebel@3mdeb.com>
Date: Wed, 31 Aug 2022 23:44:36 +0200
Subject: [PATCH 02/13] cpu/amd/pi/skinit: load and start DRTM payload

Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
---
 src/cpu/amd/pi/skinit.c | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/src/cpu/amd/pi/skinit.c b/src/cpu/amd/pi/skinit.c
index 976d6abe2fd..f9eb801a60d 100644
--- a/src/cpu/amd/pi/skinit.c
+++ b/src/cpu/amd/pi/skinit.c
@@ -1,8 +1,27 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 
+#include <cbfs.h>
+#include <cpu/x86/lapic.h>
 #include <program_loading.h>
+#include <stdlib.h>
+#include <security/tpm/tis.h>
 
 void platform_prog_run(struct prog *prog)
 {
-	/* do nothing */
+	void *skl = NULL;
+
+	/*
+	 * APs have to be in wait-for-SIPI state for at least 1000 cycles before
+	 * SKINIT. Send INIT now and assume that loading SKL from CBFS is long
+	 * enough.
+	 */
+	lapic_send_ipi_others(LAPIC_INT_LEVELTRIG | LAPIC_INT_ASSERT | LAPIC_MT_INIT);
+
+	skl = memalign(64*KiB, 64*KiB);
+
+	cbfs_load(CONFIG_CBFS_PREFIX "/drtm_payload", skl, 64*KiB);
+
+	/* TODO: fill SKL input data */
+
+	asm volatile ("skinit" :: "a"(skl));
 }

From e9c1a6ba5dfa530ab9ed1eef34fef37302798c9f Mon Sep 17 00:00:00 2001
From: Krystian Hebel <krystian.hebel@3mdeb.com>
Date: Fri, 9 Sep 2022 18:47:07 +0200
Subject: [PATCH 03/13] cpu/amd/skinit.c: pass minimal set of info required to
 boot to SKL

Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
---
 src/cpu/amd/pi/skinit.c | 106 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 105 insertions(+), 1 deletion(-)

diff --git a/src/cpu/amd/pi/skinit.c b/src/cpu/amd/pi/skinit.c
index f9eb801a60d..2fe09dc110c 100644
--- a/src/cpu/amd/pi/skinit.c
+++ b/src/cpu/amd/pi/skinit.c
@@ -6,9 +6,90 @@
 #include <stdlib.h>
 #include <security/tpm/tis.h>
 
+#include <lib.h>
+
+static uintptr_t payload_start, payload_size;
+
+/* For CBFS_TYPE_SELF (Simple Elf), prog->start and prog->size are not set so obtain it differently. */
+void platform_segment_loaded(uintptr_t start, size_t size, int flags)
+{
+	if (payload_start != 0 || payload_size != 0 || flags != SEG_FINAL)
+		die("ELF payload must have only one loadable segment for DRTM!\n");
+
+	/* SIPI vector loading also goes through this function, skip it. */
+	if (size <= 4*KiB)
+		return;
+
+	payload_start = start;
+	payload_size = size;
+}
+
+/* TODO: include tags.h from SKL somehow */
+#define SKL_TAG_CLASS_MASK       0xF0
+
+/* Tags with no particular class */
+#define SKL_TAG_NO_CLASS         0x00
+#define SKL_TAG_END              0x00
+#define SKL_TAG_SETUP_INDIRECT   0x01
+#define SKL_TAG_TAGS_SIZE        0x0F    /* Always first */
+
+/* Tags specifying kernel type */
+#define SKL_TAG_BOOT_CLASS       0x10
+#define SKL_TAG_BOOT_LINUX       0x10
+#define SKL_TAG_BOOT_MB2         0x11
+#define SKL_TAG_BOOT_SIMPLE      0x12
+
+struct skl_tag_hdr {
+	uint8_t type;
+	uint8_t len;
+} __packed;
+
+struct skl_tag_tags_size {
+	struct skl_tag_hdr hdr;
+	uint16_t size;
+} __packed;
+
+struct skl_tag_boot_simple_payload {
+	struct skl_tag_hdr hdr;
+	uint32_t base;
+	uint32_t size;
+	uint32_t entry;
+	uint32_t arg;
+} __packed;
+
+struct skl_tag_evtlog {
+	struct skl_tag_hdr hdr;
+	uint32_t address;
+	uint32_t size;
+} __packed;
+
+struct skl_tag_hash {
+	struct skl_tag_hdr hdr;
+	uint16_t algo_id;
+	uint8_t digest[];
+} __packed;
+
+static inline void *next_tag(void* t)
+{
+	void *x = t + ((struct skl_tag_hdr*)t)->len;
+	return x;
+}
+
 void platform_prog_run(struct prog *prog)
 {
 	void *skl = NULL;
+	uint16_t bootloader_data_offset;
+	struct skl_tag_tags_size *tags;
+	struct skl_tag_boot_simple_payload *sp;
+	struct skl_tag_hdr *end;
+
+	/*
+	 * Check if we're on 32b platform.
+	 * TODO: add support for 64b?
+	 */
+	assert(sizeof(skl) == 4);
+
+	hexdump(prog, sizeof(*prog));
 
 	/*
 	 * APs have to be in wait-for-SIPI state for at least 1000 cycles before
@@ -21,7 +102,30 @@ void platform_prog_run(struct prog *prog)
 
 	cbfs_load(CONFIG_CBFS_PREFIX "/drtm_payload", skl, 64*KiB);
 
-	/* TODO: fill SKL input data */
+	bootloader_data_offset = ((uint16_t *)skl)[1];
+	tags = (struct skl_tag_tags_size *)(skl + bootloader_data_offset);
+
+	memset(tags, 0, 64*KiB - (skl - (void *)tags));
+
+	tags->hdr.type = SKL_TAG_TAGS_SIZE;
+	tags->hdr.len = sizeof(struct skl_tag_tags_size);
+	tags->size += tags->hdr.len;
+
+	sp = next_tag(tags);
+	sp->hdr.type = SKL_TAG_BOOT_SIMPLE;
+	sp->hdr.len = sizeof(struct skl_tag_boot_simple_payload);
+	sp->base = payload_start;
+	sp->size = payload_size;
+	sp->entry = (uint32_t)prog->entry;
+	sp->arg = (uint32_t)prog->arg;
+	tags->size += sp->hdr.len;
+
+	/* TODO: DRTM TPM event log */
+
+	end = next_tag(sp);
+	end->type = SKL_TAG_END;
+	end->len = sizeof(struct skl_tag_hdr);
+	tags->size += end->len;
 
 	asm volatile ("skinit" :: "a"(skl));
 }

From e7d01572531a5171c7f8fe78b8c39c2192be6093 Mon Sep 17 00:00:00 2001
From: Krystian Hebel <krystian.hebel@3mdeb.com>
Date: Fri, 16 Sep 2022 13:44:52 +0200
Subject: [PATCH 04/13] cpu/amd/skinit: print MSRs connected with SMM

Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
---
 src/cpu/amd/pi/skinit.c | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/src/cpu/amd/pi/skinit.c b/src/cpu/amd/pi/skinit.c
index 2fe09dc110c..e70407d1609 100644
--- a/src/cpu/amd/pi/skinit.c
+++ b/src/cpu/amd/pi/skinit.c
@@ -5,6 +5,7 @@
 #include <program_loading.h>
 #include <stdlib.h>
 #include <security/tpm/tis.h>
+#include <cpu/amd/msr.h>
 
 #include <lib.h>
 
@@ -13,13 +14,10 @@ static uintptr_t payload_start, payload_size;
 /* For CBFS_TYPE_SELF (Simple Elf), prog->start and prog->size are not set so obtain it differently. */
 void platform_segment_loaded(uintptr_t start, size_t size, int flags)
 {
-	if (payload_start != 0 || payload_size != 0 || flags != SEG_FINAL)
+	/* FIXME: need to differentiate between payload and other loaded segments */
+	if (/*payload_start != 0 || payload_size != 0 || */flags != SEG_FINAL)
 		die("ELF payload must have only one loadable segment for DRTM!\n");
 
-	/* SIPI vector loading also goes through this function, skip it. */
-	if (size <= 4*KiB)
-		return;
-
 	payload_start = start;
 	payload_size = size;
 }
@@ -120,12 +118,26 @@ void platform_prog_run(struct prog *prog)
 	sp->arg = (uint32_t)prog->arg;
 	tags->size += sp->hdr.len;
 
-	/* TODO: DRTM TPM event log */
+	/* TODO: DRTM TPM event log and SKL hash(es) */
 
 	end = next_tag(sp);
 	end->type = SKL_TAG_END;
 	end->len = sizeof(struct skl_tag_hdr);
 	tags->size += end->len;
 
+	msr_t msr;
+
+	msr = rdmsr(SMM_BASE_MSR);
+	printk(BIOS_DEBUG, "SMM_BASE_MSR = %#8.8x%8.8x\n", msr.hi, msr.lo);
+
+	msr = rdmsr(SMM_ADDR_MSR);
+	printk(BIOS_DEBUG, "SMM_ADDR_MSR = %#8.8x%8.8x\n", msr.hi, msr.lo);
+
+	msr = rdmsr(SMM_MASK_MSR);
+	printk(BIOS_DEBUG, "SMM_MASK_MSR = %#8.8x%8.8x\n", msr.hi, msr.lo);
+
+	msr = rdmsr(HWCR_MSR);
+	printk(BIOS_DEBUG, "HWCR_MSR     = %#8.8x%8.8x\n", msr.hi, msr.lo);
+
 	asm volatile ("skinit" :: "a"(skl));
 }

From 9fc2a631e5cff7b5afb1c136a5e735817f833768 Mon Sep 17 00:00:00 2001
From: Krystian Hebel <krystian.hebel@3mdeb.com>
Date: Sun, 18 Sep 2022 13:42:30 +0200
Subject: [PATCH 05/13] configs/config.pcengines_apu2_drtm_payload: add file

Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
---
 configs/config.pcengines_apu2_drtm_payload | 50 ++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 configs/config.pcengines_apu2_drtm_payload

diff --git a/configs/config.pcengines_apu2_drtm_payload b/configs/config.pcengines_apu2_drtm_payload
new file mode 100644
index 00000000000..09bd56c963d
--- /dev/null
+++ b/configs/config.pcengines_apu2_drtm_payload
@@ -0,0 +1,50 @@
+CONFIG_LOCALVERSION="v0.9.1"
+CONFIG_OPTION_BACKEND_NONE=y
+CONFIG_VENDOR_PCENGINES=y
+CONFIG_VBOOT=y
+CONFIG_PXE_ROM_ID="8086,157b"
+CONFIG_CONSOLE_CBMEM_BUFFER_SIZE=0x100000
+CONFIG_EDK2_BOOT_TIMEOUT=6
+CONFIG_TPM_MEASURED_BOOT=y
+CONFIG_EDK2_BOOTSPLASH_FILE="3rdparty/dasharo-blobs/dasharo/bootsplash.bmp"
+CONFIG_LAUNCH_DRTM_PAYLOAD=y
+CONFIG_UDK_202005_BINDING=y
+CONFIG_NO_GFX_INIT=y
+CONFIG_DRIVERS_EFI_VARIABLE_STORE=y
+CONFIG_TPM2=y
+CONFIG_BOOTMEDIA_LOCK_CHIP=y
+CONFIG_BOOTMEDIA_LOCK_WPRO_VBOOT_RO=y
+CONFIG_BOOTMEDIA_LOCK_IN_VERSTAGE=y
+CONFIG_BOOTMEDIA_SPI_LOCK_PIN=y
+CONFIG_DEFAULT_CONSOLE_LOGLEVEL_1=y
+# CONFIG_CONSOLE_USE_LOGLEVEL_PREFIX is not set
+# CONFIG_CONSOLE_USE_ANSI_ESCAPES is not set
+CONFIG_PAYLOAD_EDK2=y
+CONFIG_EDK2_USE_EDK2_PLATFORMS=y
+CONFIG_EDK2_PLATFORMS_REPOSITORY="https://github.com/Dasharo/edk2-platforms"
+CONFIG_EDK2_PLATFORMS_TAG_OR_REV="1002a59639f111a2f8178b77d1f5fde0ea8d976f"
+CONFIG_EDK2_CBMEM_LOGGING=y
+# CONFIG_EDK2_PS2_SUPPORT is not set
+CONFIG_EDK2_SERIAL_SUPPORT=y
+CONFIG_BUILD_IPXE=y
+CONFIG_IPXE_ADD_SCRIPT=y
+CONFIG_IPXE_SCRIPT="3rdparty/dasharo-blobs/dasharo/dasharo.ipxe"
+CONFIG_IPXE_CUSTOM_BUILD_ID="0123456789"
+CONFIG_DASHARO=y
+CONFIG_EDK2_ENABLE_IPXE=y
+# CONFIG_EDK2_SECURE_BOOT_DEFAULT_ENABLE is not set
+CONFIG_EDK2_SATA_PASSWORD=y
+CONFIG_EDK2_OPAL_PASSWORD=y
+CONFIG_EDK2_SETUP_PASSWORD=y
+CONFIG_EDK2_PERFORMANCE_MEASUREMENT_ENABLE=y
+CONFIG_EDK2_DASHARO_SYSTEM_FEATURES=y
+CONFIG_EDK2_DASHARO_SECURITY_OPTIONS=y
+CONFIG_EDK2_DASHARO_USB_CONFIG=y
+CONFIG_EDK2_DASHARO_NETWORK_CONFIG=y
+CONFIG_EDK2_DASHARO_CHIPSET_CONFIG=y
+CONFIG_EDK2_DASHARO_SERIAL_REDIRECTION_DEFAULT_ENABLE=y
+CONFIG_EDK2_HAVE_2ND_UART=y
+CONFIG_EDK2_BOOT_MENU_KEY=0x0014
+CONFIG_EDK2_SETUP_MENU_KEY=0x0008
+CONFIG_EDK2_DISABLE_OPTION_ROMS=y
+CONFIG_EDK2_CREATE_PREINSTALLED_BOOT_OPTIONS=y

From 73d8d01f5c4b9df0a59a2decd64177f7e3d45cb5 Mon Sep 17 00:00:00 2001
From: Krystian Hebel <krystian.hebel@3mdeb.com>
Date: Fri, 30 Sep 2022 09:45:32 +0200
Subject: [PATCH 06/13] configs/config.pcengines_apu2_drtm_payload: enable UEFI
 shell

Signed-off-by: Krystian Hebel <krystian.hebel@3mdeb.com>
---
 configs/config.pcengines_apu2_drtm_payload | 1 +
 1 file changed, 1 insertion(+)

diff --git a/configs/config.pcengines_apu2_drtm_payload b/configs/config.pcengines_apu2_drtm_payload
index 09bd56c963d..e05bb3c6b55 100644
--- a/configs/config.pcengines_apu2_drtm_payload
+++ b/configs/config.pcengines_apu2_drtm_payload
@@ -24,6 +24,7 @@ CONFIG_EDK2_USE_EDK2_PLATFORMS=y
 CONFIG_EDK2_PLATFORMS_REPOSITORY="https://github.com/Dasharo/edk2-platforms"
 CONFIG_EDK2_PLATFORMS_TAG_OR_REV="1002a59639f111a2f8178b77d1f5fde0ea8d976f"
 CONFIG_EDK2_CBMEM_LOGGING=y
+CONFIG_EDK2_HAVE_EFI_SHELL=y
 # CONFIG_EDK2_PS2_SUPPORT is not set
 CONFIG_EDK2_SERIAL_SUPPORT=y
 CONFIG_BUILD_IPXE=y

From 8dee0f082d06ca8db629422f8253dab46427e1e1 Mon Sep 17 00:00:00 2001
From: "Marty E. Plummer" <hanetzer@startmail.com>
Date: Tue, 23 Jun 2026 14:50:36 -0500
Subject: [PATCH 07/13] amd/common: move skl here

Signed-off-by: Marty E. Plummer <hanetzer@startmail.com>
---
 src/cpu/amd/pi/Kconfig                          | 8 --------
 src/cpu/amd/pi/Makefile.mk                      | 2 --
 src/soc/amd/common/Kconfig.common               | 1 +
 src/soc/amd/common/Makefile.mk                  | 1 +
 src/soc/amd/common/skl/Kconfig                  | 9 +++++++++
 src/soc/amd/common/skl/Makefile.mk              | 3 +++
 src/{cpu/amd/pi => soc/amd/common/skl}/skinit.c | 0
 7 files changed, 14 insertions(+), 10 deletions(-)
 create mode 100644 src/soc/amd/common/skl/Kconfig
 create mode 100644 src/soc/amd/common/skl/Makefile.mk
 rename src/{cpu/amd/pi => soc/amd/common/skl}/skinit.c (100%)

diff --git a/src/cpu/amd/pi/Kconfig b/src/cpu/amd/pi/Kconfig
index 6db795c8fae..b27bfd1a28d 100644
--- a/src/cpu/amd/pi/Kconfig
+++ b/src/cpu/amd/pi/Kconfig
@@ -48,14 +48,6 @@ config SMM_TSEG_SIZE
 	default 0x100000 if HAVE_SMI_HANDLER
 	default 0x0
 
-config LAUNCH_DRTM_PAYLOAD
-	bool "Launch DRTM payload before the real one"
-	default n
-	depends on MEMORY_MAPPED_TPM
-	help
-	  Launch DRTM payload before the real one. This makes it possible to
-	  put root of trust in hardware for platforms that don't support SRTM.
-
 endif # CPU_AMD_PI
 
 source "src/cpu/amd/pi/00730F01/Kconfig"
diff --git a/src/cpu/amd/pi/Makefile.mk b/src/cpu/amd/pi/Makefile.mk
index 1e660e0ee0d..104f99bc30c 100644
--- a/src/cpu/amd/pi/Makefile.mk
+++ b/src/cpu/amd/pi/Makefile.mk
@@ -7,6 +7,4 @@ postcar-y += ../../../soc/amd/common/block/cpu/smm/smm_helper.c
 ramstage-y += ../../../soc/amd/common/block/cpu/smm/smm_helper.c
 ramstage-y += ../../../soc/amd/common/block/cpu/smm/smm_relocate.c
 
-ramstage-$(CONFIG_LAUNCH_DRTM_PAYLOAD) += skinit.c
-
 CPPFLAGS_common += -I$(src)/cpu/amd/pi/include
diff --git a/src/soc/amd/common/Kconfig.common b/src/soc/amd/common/Kconfig.common
index 2070b817913..1d10778e1e3 100644
--- a/src/soc/amd/common/Kconfig.common
+++ b/src/soc/amd/common/Kconfig.common
@@ -11,6 +11,7 @@ source "src/soc/amd/common/block/*/Kconfig"
 source "src/soc/amd/common/fsp/Kconfig"
 source "src/soc/amd/common/pi/Kconfig"
 source "src/soc/amd/common/psp_verstage/Kconfig"
+source "src/soc/amd/common/skl/Kconfig"
 
 config APCB_BLOBS_DIR
 	string "Mainboard blobs path"
diff --git a/src/soc/amd/common/Makefile.mk b/src/soc/amd/common/Makefile.mk
index b3c1499a3fe..51535b26366 100644
--- a/src/soc/amd/common/Makefile.mk
+++ b/src/soc/amd/common/Makefile.mk
@@ -4,6 +4,7 @@ subdirs-y += block
 subdirs-y += fsp
 subdirs-y += pi
 subdirs-y += vboot
+subdirs-$(CONFIG_LAUNCH_DRTM_PAYLOAD) += skl
 
 CPPFLAGS_common += -I$(src)/soc/amd/common/vboot/include
 
diff --git a/src/soc/amd/common/skl/Kconfig b/src/soc/amd/common/skl/Kconfig
new file mode 100644
index 00000000000..4e355db1568
--- /dev/null
+++ b/src/soc/amd/common/skl/Kconfig
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+config LAUNCH_DRTM_PAYLOAD
+	bool "Launch DRTM payload before the real one"
+	default n
+	depends on MEMORY_MAPPED_TPM && ARCH_RAMSTAGE_X86_32
+	help
+	  Launch DRTM payload before the real one. This makes it possible to
+	  put root of trust in hardware for platforms that don't support SRTM.
diff --git a/src/soc/amd/common/skl/Makefile.mk b/src/soc/amd/common/skl/Makefile.mk
new file mode 100644
index 00000000000..9c9afe663af
--- /dev/null
+++ b/src/soc/amd/common/skl/Makefile.mk
@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+ramstage-$(CONFIG_LAUNCH_DRTM_PAYLOAD) += skinit.c
diff --git a/src/cpu/amd/pi/skinit.c b/src/soc/amd/common/skl/skinit.c
similarity index 100%
rename from src/cpu/amd/pi/skinit.c
rename to src/soc/amd/common/skl/skinit.c

From 33e826595fdcb2da81ba70c3097079f018b1213b Mon Sep 17 00:00:00 2001
From: "Marty E. Plummer" <hanetzer@startmail.com>
Date: Tue, 23 Jun 2026 14:50:45 -0500
Subject: [PATCH 08/13] drtm: set up infra for custom repos and revisions

Signed-off-by: Marty E. Plummer <hanetzer@startmail.com>
---
 payloads/external/Makefile.mk  |  4 +++-
 payloads/external/skl/Makefile | 20 +++++++++++++++++---
 src/soc/amd/common/skl/Kconfig | 18 ++++++++++++++++++
 3 files changed, 38 insertions(+), 4 deletions(-)

diff --git a/payloads/external/Makefile.mk b/payloads/external/Makefile.mk
index 1868c470eb1..8d95b301031 100644
--- a/payloads/external/Makefile.mk
+++ b/payloads/external/Makefile.mk
@@ -582,7 +582,9 @@ endif
 # SKL
 
 payloads/external/skl/secure-kernel-loader/skl.bin:
-	$(MAKE) -C payloads/external/skl CC="$(HOSTCC)"
+	$(MAKE) -C payloads/external/skl CC="$(HOSTCC)" \
+		CONFIG_SKL_REPOSITORY=$(CONFIG_SKL_REPOSITORY) \
+		CONFIG_SKL_TAG_OR_REV=$(CONFIG_SKL_TAG_OR_REV)
 
 cbfs-files-$(CONFIG_LAUNCH_DRTM_PAYLOAD) += $(CONFIG_CBFS_PREFIX)/drtm_payload
 $(CONFIG_CBFS_PREFIX)/drtm_payload-file := payloads/external/skl/secure-kernel-loader/skl.bin
diff --git a/payloads/external/skl/Makefile b/payloads/external/skl/Makefile
index 2ae018fbd6d..042302af3b4 100644
--- a/payloads/external/skl/Makefile
+++ b/payloads/external/skl/Makefile
@@ -1,12 +1,26 @@
 ## SPDX-License-Identifier: GPL-2.0-only
-project_git_repo=https://github.com/TrenchBoot/secure-kernel-loader.git
+project_git_repo=$(CONFIG_SKL_REPOSITORY)
 project_dir=secure-kernel-loader
 
 all: skl
 
 checkout:
-	test -d $(project_dir) || \
-	    git clone $(project_git_repo) $(project_dir)
+	if [ ! -d "$(project_dir)" ]; then \
+		git clone --recurse-submodules "$(project_git_repo)" -j5; \
+	fi
+	cd "$(project_dir)"; \
+		if ! git rev-parse --verify -q $(CONFIG_SKL_TAG_OR_REV)^{object} >/dev/null; then \
+			echo "    $(CONFIG_SKL_TAG_OR_REV) is not a valid git reference"; \
+			exit 1;\
+		fi; \
+		if git status --ignore-submodules=dirty | grep -q "nothing to commit, working tree clean"; then \
+			echo "    Checking out secure-kernel-loader $(CONFIG_SKL_TAG_OR_REV)"; \
+			git checkout --detach $(CONFIG_SKL_TAG_OR_REV) -f; \
+		else \
+			echo "    Working directory not clean; will not overwrite"; \
+		fi; \
+		git submodule update --init --checkout
+
 
 skl: checkout
 	$(MAKE) -C $(project_dir) DEBUG=y
diff --git a/src/soc/amd/common/skl/Kconfig b/src/soc/amd/common/skl/Kconfig
index 4e355db1568..3d44022bfdb 100644
--- a/src/soc/amd/common/skl/Kconfig
+++ b/src/soc/amd/common/skl/Kconfig
@@ -7,3 +7,21 @@ config LAUNCH_DRTM_PAYLOAD
 	help
 	  Launch DRTM payload before the real one. This makes it possible to
 	  put root of trust in hardware for platforms that don't support SRTM.
+
+if LAUNCH_DRTM_PAYLOAD
+
+config SKL_REPOSITORY
+	string "URL to git repository for secure-kernel-loader"
+	default "https://github.com/TrenchBoot/secure-kernel-loader.git"
+	help
+	  TODO
+
+config SKL_TAG_OR_REV
+	string "Insert a commit's SHA-1 or a branch name"
+	default "de1899007d038eeacf5edb8e63c0f0a4b3e265c4"
+	help
+	  The commit's SHA-1 or branch name of the revision to use. This must exist in
+	  SKL_REPOSITORY, and in the case of a branch name, prefixed with origin i.e.
+	  "origin/skl-loader-amdsl-v11"
+
+endif # LAUNCH_DRTM_PAYLOAD

From dffd265e3d6a0357bacfc3b4d79fb4babe8c6d47 Mon Sep 17 00:00:00 2001
From: "Marty E. Plummer" <hanetzer@startmail.com>
Date: Tue, 23 Jun 2026 14:50:50 -0500
Subject: [PATCH 09/13] skinit: use slrt.h from secure-kernel-loader

Signed-off-by: Marty E. Plummer <hanetzer@startmail.com>
---
 src/soc/amd/common/skl/Makefile.mk    |   2 +
 src/soc/amd/common/skl/include/slrt.h | 129 ++++++++++++++++++++++++++
 src/soc/amd/common/skl/skinit.c       |   1 +
 3 files changed, 132 insertions(+)
 create mode 100644 src/soc/amd/common/skl/include/slrt.h

diff --git a/src/soc/amd/common/skl/Makefile.mk b/src/soc/amd/common/skl/Makefile.mk
index 9c9afe663af..52f2db01c7e 100644
--- a/src/soc/amd/common/skl/Makefile.mk
+++ b/src/soc/amd/common/skl/Makefile.mk
@@ -1,3 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0-only
 
 ramstage-$(CONFIG_LAUNCH_DRTM_PAYLOAD) += skinit.c
+
+CPPFLAGS_common += -I$(src)/soc/amd/common/skl/include/
diff --git a/src/soc/amd/common/skl/include/slrt.h b/src/soc/amd/common/skl/include/slrt.h
new file mode 100644
index 00000000000..ddd2e6dcda2
--- /dev/null
+++ b/src/soc/amd/common/skl/include/slrt.h
@@ -0,0 +1,129 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+#ifndef __SLRT_H__
+#define __SLRT_H__
+
+#include <types.h>
+
+/* SLR Table header values */
+#define SLR_TABLE_MAGIC         0x4452544d
+#define SLR_TABLE_REVISION      1
+
+/* Current revisions for the policy and UEFI config */
+#define SLR_POLICY_REVISION     1
+#define SLR_UEFI_CONFIG_REVISION 1
+
+/* SLR defined architectures */
+#define SLR_INTEL_TXT           1
+#define SLR_AMD_SKINIT          2
+
+/* SLR defined bootloaders */
+#define SLR_BOOTLOADER_INVALID  0
+#define SLR_BOOTLOADER_GRUB     1
+
+/* Log formats */
+#define SLR_DRTM_TPM12_LOG      1
+#define SLR_DRTM_TPM20_LOG      2
+
+/* Array Lengths */
+#define TPM_EVENT_INFO_LENGTH   32
+
+/* Tags */
+#define SLR_ENTRY_INVALID       0x0000
+#define SLR_ENTRY_DL_INFO       0x0001
+#define SLR_ENTRY_LOG_INFO      0x0002
+#define SLR_ENTRY_ENTRY_POLICY  0x0003
+#define SLR_ENTRY_INTEL_INFO    0x0004
+#define SLR_ENTRY_AMD_INFO      0x0005
+#define SLR_ENTRY_ARM_INFO      0x0006
+#define SLR_ENTRY_UEFI_INFO     0x0007
+#define SLR_ENTRY_UEFI_CONFIG   0x0008
+#define SLR_ENTRY_END           0xffff
+
+/*
+ * sl_header as given by AMD
+ */
+struct sl_header {
+    u16 skl_entry_point;
+    u16 skl_measured_size;
+    u8 reserved[62];
+    u16 skl_info_offset;
+    u16 bootloader_data_offset;
+} __packed;
+
+/*
+ * Common SLRT Table Header
+ */
+struct slr_entry_hdr {
+    u32 tag;
+    u32 size;
+} __packed;
+
+/*
+ * Primary Secure Launch Resource Table Header
+ */
+struct slr_table {
+    u32 magic;
+    u16 revision;
+    u16 architecture;
+    u32 size;
+    u32 max_size;
+    /* Not really a flex array, don't use it that way! */
+    struct slr_entry_hdr entries[];
+} __packed;
+
+/*
+ * Boot loader context
+ */
+struct slr_bl_context {
+    u16 bootloader;
+    u16 reserved[3];
+    u64 context;
+} __packed;
+
+/*
+ * DRTM Dynamic Launch Configuration
+ */
+struct slr_entry_dl_info {
+    struct slr_entry_hdr hdr;
+    u64 dce_size;
+    u64 dce_base;
+    u64 dlme_size;
+    u64 dlme_base;
+    u64 dlme_entry; /* Offset from dlme_base */
+    struct slr_bl_context bl_context;
+    u64 dl_handler;
+} __packed;
+
+/*
+ * TPM Log Information
+ */
+struct slr_entry_log_info {
+    struct slr_entry_hdr hdr;
+    u16 format;
+    u16 reserved;
+    u32 size;
+    u64 addr;
+} __packed;
+
+/*
+ * AMD SKINIT Info table
+ */
+struct slr_entry_amd_info {
+    struct slr_entry_hdr hdr;
+    u64 next;
+    u32 type;
+    u32 len;
+    u64 slrt_size;
+    u64 slrt_base;
+    u64 boot_params_base;
+    u16 psp_version;
+    u16 reserved[3];
+} __packed;
+
+static inline void *next_entry(void* t)
+{
+    void *x = t + ((struct slr_entry_hdr*)t)->size;
+    return x;
+}
+
+#endif /* __SLRT_H__ */
diff --git a/src/soc/amd/common/skl/skinit.c b/src/soc/amd/common/skl/skinit.c
index e70407d1609..a01b995de6b 100644
--- a/src/soc/amd/common/skl/skinit.c
+++ b/src/soc/amd/common/skl/skinit.c
@@ -6,6 +6,7 @@
 #include <stdlib.h>
 #include <security/tpm/tis.h>
 #include <cpu/amd/msr.h>
+#include <slrt.h>
 
 #include <lib.h>
 

From 48d89394d595e007d273ad8273f5c022ae940369 Mon Sep 17 00:00:00 2001
From: "Marty E. Plummer" <hanetzer@startmail.com>
Date: Tue, 23 Jun 2026 14:50:54 -0500
Subject: [PATCH 10/13] skinit: move to slrt tags

Signed-off-by: Marty E. Plummer <hanetzer@startmail.com>
---
 src/soc/amd/common/skl/skinit.c | 99 +++++++++------------------------
 1 file changed, 25 insertions(+), 74 deletions(-)

diff --git a/src/soc/amd/common/skl/skinit.c b/src/soc/amd/common/skl/skinit.c
index a01b995de6b..4504f0338b3 100644
--- a/src/soc/amd/common/skl/skinit.c
+++ b/src/soc/amd/common/skl/skinit.c
@@ -23,70 +23,19 @@ void platform_segment_loaded(uintptr_t start, size_t size, int flags)
 	payload_size = size;
 }
 
-/* TODO: include tags.h from SKL somehow */
-#define SKL_TAG_CLASS_MASK       0xF0
-
-/* Tags with no particular class */
-#define SKL_TAG_NO_CLASS         0x00
-#define SKL_TAG_END              0x00
-#define SKL_TAG_SETUP_INDIRECT   0x01
-#define SKL_TAG_TAGS_SIZE        0x0F    /* Always first */
-
-/* Tags specifying kernel type */
-#define SKL_TAG_BOOT_CLASS       0x10
-#define SKL_TAG_BOOT_LINUX       0x10
-#define SKL_TAG_BOOT_MB2         0x11
-#define SKL_TAG_BOOT_SIMPLE      0x12
-
-struct skl_tag_hdr {
-	uint8_t type;
-	uint8_t len;
-} __packed;
-
-struct skl_tag_tags_size {
-	struct skl_tag_hdr hdr;
-	uint16_t size;
-} __packed;
-
-struct skl_tag_boot_simple_payload {
-	struct skl_tag_hdr hdr;
-	uint32_t base;
-	uint32_t size;
-	uint32_t entry;
-	uint32_t arg;
-} __packed;
-
-struct skl_tag_evtlog {
-	struct skl_tag_hdr hdr;
-	uint32_t address;
-	uint32_t size;
-} __packed;
-
-struct skl_tag_hash {
-	struct skl_tag_hdr hdr;
-	uint16_t algo_id;
-	uint8_t digest[];
-} __packed;
-
-static inline void *next_tag(void* t)
-{
-	void *x = t + ((struct skl_tag_hdr*)t)->len;
-	return x;
-}
-
 void platform_prog_run(struct prog *prog)
 {
 	void *skl = NULL;
 	uint16_t bootloader_data_offset;
-	struct skl_tag_tags_size *tags;
-	struct skl_tag_boot_simple_payload *sp;
-	struct skl_tag_hdr *end;
+	struct slr_table *slrt;
+	struct slr_entry_dl_info *dl_info;
+	struct slr_entry_hdr *end;
 
 	/*
 	 * Check if we're on 32b platform.
 	 * TODO: add support for 64b?
 	 */
-	assert(sizeof(skl) == 4);
+	_Static_assert(sizeof(skl) == 4);
 
 	hexdump(prog, sizeof(*prog));
 
@@ -101,30 +50,32 @@ void platform_prog_run(struct prog *prog)
 
 	cbfs_load(CONFIG_CBFS_PREFIX "/drtm_payload", skl, 64*KiB);
 
-	bootloader_data_offset = ((uint16_t *)skl)[1];
-	tags = (struct skl_tag_tags_size *)(skl + bootloader_data_offset);
+	bootloader_data_offset = ((struct sl_header *)skl)->bootloader_data_offset;
+	slrt = (struct slr_table *)(skl + bootloader_data_offset);
 
-	memset(tags, 0, 64*KiB - (skl - (void *)tags));
+	memset(slrt, 0, 64*KiB - (skl - (void *)slrt));
 
-	tags->hdr.type = SKL_TAG_TAGS_SIZE;
-	tags->hdr.len = sizeof(struct skl_tag_tags_size);
-	tags->size += tags->hdr.len;
+	slrt->magic = SLR_TABLE_MAGIC;
+	slrt->revision = SLR_TABLE_REVISION;
+	slrt->architecture = SLR_AMD_SKINIT;
+	slrt->size = sizeof(*slrt);
+	slrt->max_size = 64*KiB - bootloader_data_offset;
 
-	sp = next_tag(tags);
-	sp->hdr.type = SKL_TAG_BOOT_SIMPLE;
-	sp->hdr.len = sizeof(struct skl_tag_boot_simple_payload);
-	sp->base = payload_start;
-	sp->size = payload_size;
-	sp->entry = (uint32_t)prog->entry;
-	sp->arg = (uint32_t)prog->arg;
-	tags->size += sp->hdr.len;
+	dl_info = (struct slr_entry_dl_info *)slrt->entries;
+	dl_info->hdr.tag = SLR_ENTRY_DL_INFO;
+	dl_info->hdr.size = sizeof(struct slr_entry_dl_info);
+	dl_info->dlme_base = payload_start;
+	dl_info->dlme_size = payload_size;
+	dl_info->dlme_entry = (uint32_t)prog->entry - payload_start;
+	dl_info->bl_context.bootloader = SLR_BOOTLOADER_GRUB; // TODO: BOOTLOADER_COREBOOT?
+	slrt->size += dl_info->hdr.size;
 
-	/* TODO: DRTM TPM event log and SKL hash(es) */
+	end = next_entry(dl_info);
+	end->tag = SLR_ENTRY_END;
+	end->size = sizeof(struct slr_entry_hdr);
+	slrt->size += end->size;
 
-	end = next_tag(sp);
-	end->type = SKL_TAG_END;
-	end->len = sizeof(struct skl_tag_hdr);
-	tags->size += end->len;
+	/* TODO: DRTM TPM event log and SKL hash(es) */
 
 	msr_t msr;
 

From 7c6348decc3588ac811f2e966aaa77dcdb72a712 Mon Sep 17 00:00:00 2001
From: "Marty E. Plummer" <hanetzer@startmail.com>
Date: Sun, 28 Jun 2026 14:42:16 -0500
Subject: [PATCH 11/13] skinit: stub out slr_entry_amd_info

Signed-off-by: Marty E. Plummer <hanetzer@startmail.com>
---
 src/soc/amd/common/skl/skinit.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/soc/amd/common/skl/skinit.c b/src/soc/amd/common/skl/skinit.c
index 4504f0338b3..af7118f34d4 100644
--- a/src/soc/amd/common/skl/skinit.c
+++ b/src/soc/amd/common/skl/skinit.c
@@ -29,6 +29,7 @@ void platform_prog_run(struct prog *prog)
 	uint16_t bootloader_data_offset;
 	struct slr_table *slrt;
 	struct slr_entry_dl_info *dl_info;
+	struct slr_entry_amd_info *amd_info;
 	struct slr_entry_hdr *end;
 
 	/*
@@ -70,7 +71,12 @@ void platform_prog_run(struct prog *prog)
 	dl_info->bl_context.bootloader = SLR_BOOTLOADER_GRUB; // TODO: BOOTLOADER_COREBOOT?
 	slrt->size += dl_info->hdr.size;
 
-	end = next_entry(dl_info);
+	amd_info = next_entry(dl_info);
+	amd_info->hdr.tag = SLR_ENTRY_AMD_INFO;
+	amd_info->hdr.size = sizeof(*amd_info);
+	slrt->size += amd_info->hdr.size;
+
+	end = next_entry(amd_info);
 	end->tag = SLR_ENTRY_END;
 	end->size = sizeof(struct slr_entry_hdr);
 	slrt->size += end->size;

From 3968375eeae7d221815d098b379cdb6721ad7639 Mon Sep 17 00:00:00 2001
From: "Marty E. Plummer" <hanetzer@startmail.com>
Date: Sun, 28 Jun 2026 15:12:02 -0500
Subject: [PATCH 12/13] skinit: stub out slr_entry_log_info

Signed-off-by: Marty E. Plummer <hanetzer@startmail.com>
---
 src/soc/amd/common/skl/skinit.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/soc/amd/common/skl/skinit.c b/src/soc/amd/common/skl/skinit.c
index af7118f34d4..10b280f70ac 100644
--- a/src/soc/amd/common/skl/skinit.c
+++ b/src/soc/amd/common/skl/skinit.c
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 
 #include <cbfs.h>
+#include <cbmem.h>
 #include <cpu/x86/lapic.h>
 #include <program_loading.h>
 #include <stdlib.h>
@@ -30,7 +31,9 @@ void platform_prog_run(struct prog *prog)
 	struct slr_table *slrt;
 	struct slr_entry_dl_info *dl_info;
 	struct slr_entry_amd_info *amd_info;
+	struct slr_entry_log_info *log_info;
 	struct slr_entry_hdr *end;
+	const struct cbmem_entry *ce;
 
 	/*
 	 * Check if we're on 32b platform.
@@ -76,7 +79,19 @@ void platform_prog_run(struct prog *prog)
 	amd_info->hdr.size = sizeof(*amd_info);
 	slrt->size += amd_info->hdr.size;
 
-	end = next_entry(amd_info);
+	log_info = next_entry(amd_info);
+	log_info->hdr.tag = SLR_ENTRY_LOG_INFO;
+	log_info->hdr.size = sizeof(*log_info);
+	slrt->size += log_info->hdr.size;
+	ce = cbmem_entry_find(CBMEM_ID_TPM2_TCG_LOG);
+	if (ce) {
+		log_info->addr = (uintptr_t)cbmem_entry_start(ce);
+		log_info->size = cbmem_entry_size(ce);
+		log_info->format = SLR_DRTM_TPM20_LOG; // TODO: Support 1.2?
+	} else
+		printk(BIOS_ERR, "Could not find TPM2 CBMEM Entry\n");
+
+	end = next_entry(log_info);
 	end->tag = SLR_ENTRY_END;
 	end->size = sizeof(struct slr_entry_hdr);
 	slrt->size += end->size;

From 7ff8f3fa131ecce2baa4a5280c36cf154916317e Mon Sep 17 00:00:00 2001
From: "Marty E. Plummer" <hanetzer@startmail.com>
Date: Sun, 28 Jun 2026 17:46:57 -0500
Subject: [PATCH 13/13] skinit: address feedback

Signed-off-by: Marty E. Plummer <hanetzer@startmail.com>
---
 src/soc/amd/common/skl/skinit.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/soc/amd/common/skl/skinit.c b/src/soc/amd/common/skl/skinit.c
index 10b280f70ac..b7a2379a51d 100644
--- a/src/soc/amd/common/skl/skinit.c
+++ b/src/soc/amd/common/skl/skinit.c
@@ -41,8 +41,6 @@ void platform_prog_run(struct prog *prog)
 	 */
 	_Static_assert(sizeof(skl) == 4);
 
-	hexdump(prog, sizeof(*prog));
-
 	/*
 	 * APs have to be in wait-for-SIPI state for at least 1000 cycles before
 	 * SKINIT. Send INIT now and assume that loading SKL from CBFS is long
@@ -51,14 +49,17 @@ void platform_prog_run(struct prog *prog)
 	lapic_send_ipi_others(LAPIC_INT_LEVELTRIG | LAPIC_INT_ASSERT | LAPIC_MT_INIT);
 
 	skl = memalign(64*KiB, 64*KiB);
+	if (!skl)
+		die("Could not reserve memory for DRTM\n");
+
+	memset(slrt, 0, 64*KiB - (skl - (void *)slrt));
 
-	cbfs_load(CONFIG_CBFS_PREFIX "/drtm_payload", skl, 64*KiB);
+	if (!cbfs_load(CONFIG_CBFS_PREFIX "/drtm_payload", skl, 64*KiB))
+		die("Could not load DRTM payload\n");
 
 	bootloader_data_offset = ((struct sl_header *)skl)->bootloader_data_offset;
 	slrt = (struct slr_table *)(skl + bootloader_data_offset);
 
-	memset(slrt, 0, 64*KiB - (skl - (void *)slrt));
-
 	slrt->magic = SLR_TABLE_MAGIC;
 	slrt->revision = SLR_TABLE_REVISION;
 	slrt->architecture = SLR_AMD_SKINIT;