Merge pull request 'supermicro x11ssh_f: Use deguard-configured ME image instead of SPS and disable ME HECI in devicetree' (#404) from noisytoot/supermicro-x11ssh-f into master

Reviewed-on: https://codeberg.org/libreboot/lbmk/pulls/404

9 files changed, 711 insertions, 8 deletions

diff --git a/config/coreboot/default/patches/0049-mb-supermicro-x11-lga1151-series-Disable-ME-HECI-in-.patch b/config/coreboot/default/patches/0049-mb-supermicro-x11-lga1151-series-Disable-ME-HECI-in-.patch
new file mode 100644
index 00000000..cae84975
--- /dev/null
+++ b/config/coreboot/default/patches/0049-mb-supermicro-x11-lga1151-series-Disable-ME-HECI-in-.patch
@@ -0,0 +1,31 @@
+From 6c6b7a71bfb36f9639abe72066851de22aa4f1ca Mon Sep 17 00:00:00 2001
+From: Ron Nazarov <ron@noisytoot.org>
+Date: Sat, 14 Feb 2026 20:13:01 +0000
+Subject: [PATCH] mb/supermicro/x11-lga1151-series: Disable ME HECI in
+ devicetree
+
+Since we always use me_cleaner, this speeds up boot time by preventing
+coreboot from wasting a few seconds waiting for HECI.
+
+Change-Id: Ifbb16ba9f09129795dabe7861260ea4d995c0350
+Signed-off-by: Ron Nazarov <ron@noisytoot.org>
+---
+ src/mainboard/supermicro/x11-lga1151-series/devicetree.cb | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/mainboard/supermicro/x11-lga1151-series/devicetree.cb b/src/mainboard/supermicro/x11-lga1151-series/devicetree.cb
+index fbf896c6ae..aa09a41f2f 100644
+--- a/src/mainboard/supermicro/x11-lga1151-series/devicetree.cb
++++ b/src/mainboard/supermicro/x11-lga1151-series/devicetree.cb
+@@ -15,7 +15,7 @@ chip soc/intel/skylake
+ 		device ref sa_thermal on end
+ 		device ref south_xhci on end
+ 		device ref thermal on end
+-		device ref heci1 on end
++		device ref heci1 off end
+ 		device ref sata on
+ 			register "SataSalpSupport" = "1"
+ 			register "SataPortsEnable" = "{
+-- 
+2.52.0
+
diff --git a/config/coreboot/supermicro_x11ssh_f_vfsp_16mb/target.cfg b/config/coreboot/supermicro_x11ssh_f_vfsp_16mb/target.cfg
index 1909de01..11058697 100644
--- a/config/coreboot/supermicro_x11ssh_f_vfsp_16mb/target.cfg
+++ b/config/coreboot/supermicro_x11ssh_f_vfsp_16mb/target.cfg
@@ -11,4 +11,3 @@ vcfg="supermicro_x11_lga1151_series"
 build_depend="seabios/default grub/xhci_nvme memtest86plus u-boot/amd64coreboot"
 IFD_platform="sklkbl"
 payload_uboot="amd64"
-release="n"
diff --git a/config/deguard/patches/0001-Replace-usr-bin-python3-with-usr-bin-env-python3.patch b/config/deguard/patches/0001-Replace-usr-bin-python3-with-usr-bin-env-python3.patch
new file mode 100644
index 00000000..d5dc0dcc
--- /dev/null
+++ b/config/deguard/patches/0001-Replace-usr-bin-python3-with-usr-bin-env-python3.patch
@@ -0,0 +1,61 @@
+From 80a8aeec376621b633634a092aa13e795de2fbce Mon Sep 17 00:00:00 2001
+From: Ron Nazarov <ron@noisytoot.org>
+Date: Sat, 14 Feb 2026 18:13:21 +0000
+Subject: [PATCH 1/4] Replace "#!/usr/bin/python3" with "#!/usr/bin/env
+ python3"
+
+Makes this work on Guix, which has /usr/bin/env but does not install
+python3 into /usr/bin.
+
+Change-Id: I5da9d2e975f6465ce5eea27476152afffe301112
+Signed-off-by: Ron Nazarov <ron@noisytoot.org>
+---
+ finalimage.py    | 2 +-
+ gen_shellcode.py | 2 +-
+ generatedelta.py | 2 +-
+ mfsutil.py       | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/finalimage.py b/finalimage.py
+index c77f5f4..e3fbd01 100755
+--- a/finalimage.py
++++ b/finalimage.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3
++#!/usr/bin/env python3
+ # SPDX-License-Identifier: GPL-2.0-only
+ 
+ import argparse
+diff --git a/gen_shellcode.py b/gen_shellcode.py
+index 1d8fbfb..0e1130a 100755
+--- a/gen_shellcode.py
++++ b/gen_shellcode.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3
++#!/usr/bin/env python3
+ # SPDX-License-Identifier: GPL-2.0-only
+ 
+ import argparse
+diff --git a/generatedelta.py b/generatedelta.py
+index 9153d61..0b35c1f 100755
+--- a/generatedelta.py
++++ b/generatedelta.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3
++#!/usr/bin/env python3
+ # SPDX-License-Identifier: GPL-2.0-only
+ 
+ import argparse
+diff --git a/mfsutil.py b/mfsutil.py
+index 246d213..7171e5f 100755
+--- a/mfsutil.py
++++ b/mfsutil.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3
++#!/usr/bin/env python3
+ # SPDX-License-Identifier: GPL-2.0-only
+ # This code is based on MFSUtil by Youness Alaoui (see `doc/LICENSE.orig` for original copyright)
+ 
+-- 
+2.52.0
+
diff --git a/config/deguard/patches/0002-data-delta-Add-Dell-OptiPlex-5050-SFF.patch b/config/deguard/patches/0002-data-delta-Add-Dell-OptiPlex-5050-SFF.patch
new file mode 100644
index 00000000..11a19cd3
--- /dev/null
+++ b/config/deguard/patches/0002-data-delta-Add-Dell-OptiPlex-5050-SFF.patch
@@ -0,0 +1,287 @@
+From 28910ca7d4b227840dbcbbc5ee6ca760746d75a1 Mon Sep 17 00:00:00 2001
+From: Ron Nazarov <ron@noisytoot.org>
+Date: Sat, 14 Feb 2026 18:14:31 +0000
+Subject: [PATCH 2/4] data/delta: Add Dell OptiPlex 5050 SFF
+
+Data obtained from a dump of the stock BIOS of my OptiPlex 5050 SFF,
+with ME version 11.8.60.3561.
+
+Change-Id: I13c4ef39a0138ad9e08444b2d3e64f26a4f2586e
+Signed-off-by: Ron Nazarov <ron@noisytoot.org>
+---
+ .../home/bup/bup_sku/emu_fuse_map                 | Bin 0 -> 7 bytes
+ .../home/bup/bup_sku/fuse_ip_base                 | Bin 0 -> 18 bytes
+ .../optiplex_5050sff/home/bup/bup_sku/plat_n_sku  |   1 +
+ data/delta/optiplex_5050sff/home/bup/invokemebx   | Bin 0 -> 4 bytes
+ data/delta/optiplex_5050sff/home/bup/mbp          | Bin 0 -> 52 bytes
+ data/delta/optiplex_5050sff/home/gpio/csme_pins   | Bin 0 -> 60 bytes
+ data/delta/optiplex_5050sff/home/icc/dynregs      | Bin 0 -> 36 bytes
+ data/delta/optiplex_5050sff/home/icc/header       | Bin 0 -> 4 bytes
+ data/delta/optiplex_5050sff/home/icc/namestr      | Bin 0 -> 48 bytes
+ data/delta/optiplex_5050sff/home/icc/prof0        | Bin 0 -> 120 bytes
+ data/delta/optiplex_5050sff/home/icc/prof1        |   0
+ data/delta/optiplex_5050sff/home/icc/prof10       |   0
+ data/delta/optiplex_5050sff/home/icc/prof2        |   0
+ data/delta/optiplex_5050sff/home/icc/prof3        |   0
+ data/delta/optiplex_5050sff/home/icc/prof4        |   0
+ data/delta/optiplex_5050sff/home/icc/prof5        |   0
+ data/delta/optiplex_5050sff/home/icc/prof6        |   0
+ data/delta/optiplex_5050sff/home/icc/prof7        |   0
+ data/delta/optiplex_5050sff/home/icc/prof8        |   0
+ data/delta/optiplex_5050sff/home/icc/prof9        |   0
+ data/delta/optiplex_5050sff/home/mca/eom          |   1 +
+ data/delta/optiplex_5050sff/home/mca/ish_policy   | Bin 0 -> 1 bytes
+ .../delta/optiplex_5050sff/home/mctp/device_ports | Bin 0 -> 4 bytes
+ .../optiplex_5050sff/home/policy/Bist/auto_config | Bin 0 -> 4 bytes
+ .../optiplex_5050sff/home/policy/cfgmgr/cfg_rules | Bin 0 -> 660 bytes
+ .../optiplex_5050sff/home/policy/hci/sysintid1    |   1 +
+ .../optiplex_5050sff/home/policy/hci/sysintid2    |   1 +
+ .../optiplex_5050sff/home/policy/hci/sysintid3    |   1 +
+ .../optiplex_5050sff/home/policy/pwdmgr/segreto   |   1 +
+ 29 files changed, 6 insertions(+)
+ create mode 100644 data/delta/optiplex_5050sff/home/bup/bup_sku/emu_fuse_map
+ create mode 100644 data/delta/optiplex_5050sff/home/bup/bup_sku/fuse_ip_base
+ create mode 100644 data/delta/optiplex_5050sff/home/bup/bup_sku/plat_n_sku
+ create mode 100644 data/delta/optiplex_5050sff/home/bup/invokemebx
+ create mode 100644 data/delta/optiplex_5050sff/home/bup/mbp
+ create mode 100644 data/delta/optiplex_5050sff/home/gpio/csme_pins
+ create mode 100644 data/delta/optiplex_5050sff/home/icc/dynregs
+ create mode 100644 data/delta/optiplex_5050sff/home/icc/header
+ create mode 100644 data/delta/optiplex_5050sff/home/icc/namestr
+ create mode 100644 data/delta/optiplex_5050sff/home/icc/prof0
+ create mode 100644 data/delta/optiplex_5050sff/home/icc/prof1
+ create mode 100644 data/delta/optiplex_5050sff/home/icc/prof10
+ create mode 100644 data/delta/optiplex_5050sff/home/icc/prof2
+ create mode 100644 data/delta/optiplex_5050sff/home/icc/prof3
+ create mode 100644 data/delta/optiplex_5050sff/home/icc/prof4
+ create mode 100644 data/delta/optiplex_5050sff/home/icc/prof5
+ create mode 100644 data/delta/optiplex_5050sff/home/icc/prof6
+ create mode 100644 data/delta/optiplex_5050sff/home/icc/prof7
+ create mode 100644 data/delta/optiplex_5050sff/home/icc/prof8
+ create mode 100644 data/delta/optiplex_5050sff/home/icc/prof9
+ create mode 100644 data/delta/optiplex_5050sff/home/mca/eom
+ create mode 100644 data/delta/optiplex_5050sff/home/mca/ish_policy
+ create mode 100644 data/delta/optiplex_5050sff/home/mctp/device_ports
+ create mode 100644 data/delta/optiplex_5050sff/home/policy/Bist/auto_config
+ create mode 100644 data/delta/optiplex_5050sff/home/policy/cfgmgr/cfg_rules
+ create mode 100644 data/delta/optiplex_5050sff/home/policy/hci/sysintid1
+ create mode 100644 data/delta/optiplex_5050sff/home/policy/hci/sysintid2
+ create mode 100644 data/delta/optiplex_5050sff/home/policy/hci/sysintid3
+ create mode 100644 data/delta/optiplex_5050sff/home/policy/pwdmgr/segreto
+
+diff --git a/data/delta/optiplex_5050sff/home/bup/bup_sku/emu_fuse_map b/data/delta/optiplex_5050sff/home/bup/bup_sku/emu_fuse_map
+new file mode 100644
+index 0000000000000000000000000000000000000000..1f4f3eb7419b5ea25288c3599be36ed94eb56bb5
+GIT binary patch
+literal 7
+OcmZ>3cVysUU;_XKiUA=2
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/optiplex_5050sff/home/bup/bup_sku/fuse_ip_base b/data/delta/optiplex_5050sff/home/bup/bup_sku/fuse_ip_base
+new file mode 100644
+index 0000000000000000000000000000000000000000..658a9660e31c0501f3e9fba168279fecec236f8b
+GIT binary patch
+literal 18
+ZcmWe&P-3uPSje!M;Q^BeQzX+xCIBG91Q`GT
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/optiplex_5050sff/home/bup/bup_sku/plat_n_sku b/data/delta/optiplex_5050sff/home/bup/bup_sku/plat_n_sku
+new file mode 100644
+index 0000000..b45f3e7
+--- /dev/null
++++ b/data/delta/optiplex_5050sff/home/bup/bup_sku/plat_n_sku
+@@ -0,0 +1 @@
++-
€
+\ No newline at end of file
+diff --git a/data/delta/optiplex_5050sff/home/bup/invokemebx b/data/delta/optiplex_5050sff/home/bup/invokemebx
+new file mode 100644
+index 0000000000000000000000000000000000000000..593f4708db84ac8fd0f5cc47c634f38c013fe9e4
+GIT binary patch
+literal 4
+LcmZQzU|;|M00aO5
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/optiplex_5050sff/home/bup/mbp b/data/delta/optiplex_5050sff/home/bup/mbp
+new file mode 100644
+index 0000000000000000000000000000000000000000..bc468268729dcbdc0beb4bb7564e0504dd96e17f
+GIT binary patch
+literal 52
+xcmd;OV_;z9U}69PMph;UB^D<qMkXc(2SGtYMouOM=YW5WY>Z&}1{Mg-003FB1Q!4R
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/optiplex_5050sff/home/gpio/csme_pins b/data/delta/optiplex_5050sff/home/gpio/csme_pins
+new file mode 100644
+index 0000000000000000000000000000000000000000..26f58aa7459be077adca09c86a19b58356c8c165
+GIT binary patch
+literal 60
+lcmZQzU|?W@Vju-(a{y^ZAm#@N00BrI#0SwlKnwyPHUI}S06qW!
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/optiplex_5050sff/home/icc/dynregs b/data/delta/optiplex_5050sff/home/icc/dynregs
+new file mode 100644
+index 0000000000000000000000000000000000000000..23c1ea2751fd4615995e5930e844e1abd9b58557
+GIT binary patch
+literal 36
+jcmY#kU}RuoU|?VpV81gH3Z8yoU{Diaz9V21QU<~Ru6_#V
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/optiplex_5050sff/home/icc/header b/data/delta/optiplex_5050sff/home/icc/header
+new file mode 100644
+index 0000000000000000000000000000000000000000..4b75556082e2c00ea8a888450d05627b20f0ec61
+GIT binary patch
+literal 4
+LcmZQ%U|<9Q00{sC
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/optiplex_5050sff/home/icc/namestr b/data/delta/optiplex_5050sff/home/icc/namestr
+new file mode 100644
+index 0000000000000000000000000000000000000000..6f8c6989c84e6c19cdc026f95c6148b436fd4486
+GIT binary patch
+literal 48
+ecmWG2%1_J8NmVdlKn1}iiFqlBMJcGF3=9Cwn+8(=
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/optiplex_5050sff/home/icc/prof0 b/data/delta/optiplex_5050sff/home/icc/prof0
+new file mode 100644
+index 0000000000000000000000000000000000000000..dab085a9f50507ce36b5fd1a2c47661f81937372
+GIT binary patch
+literal 120
+zcmWeozo*7wbe=&#T|k`y2r?KL8F+v+a{%L81|x?5f{Ki9nHiWF{2YLMAYe-Z(e?~&
+eDG-`170QRwY#C5KlxE9>@}V@B0OK7Npg912zZd}k
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/optiplex_5050sff/home/icc/prof1 b/data/delta/optiplex_5050sff/home/icc/prof1
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/optiplex_5050sff/home/icc/prof10 b/data/delta/optiplex_5050sff/home/icc/prof10
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/optiplex_5050sff/home/icc/prof2 b/data/delta/optiplex_5050sff/home/icc/prof2
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/optiplex_5050sff/home/icc/prof3 b/data/delta/optiplex_5050sff/home/icc/prof3
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/optiplex_5050sff/home/icc/prof4 b/data/delta/optiplex_5050sff/home/icc/prof4
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/optiplex_5050sff/home/icc/prof5 b/data/delta/optiplex_5050sff/home/icc/prof5
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/optiplex_5050sff/home/icc/prof6 b/data/delta/optiplex_5050sff/home/icc/prof6
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/optiplex_5050sff/home/icc/prof7 b/data/delta/optiplex_5050sff/home/icc/prof7
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/optiplex_5050sff/home/icc/prof8 b/data/delta/optiplex_5050sff/home/icc/prof8
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/optiplex_5050sff/home/icc/prof9 b/data/delta/optiplex_5050sff/home/icc/prof9
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/optiplex_5050sff/home/mca/eom b/data/delta/optiplex_5050sff/home/mca/eom
+new file mode 100644
+index 0000000..6b2aaa7
+--- /dev/null
++++ b/data/delta/optiplex_5050sff/home/mca/eom
+@@ -0,0 +1 @@
++

+\ No newline at end of file
+diff --git a/data/delta/optiplex_5050sff/home/mca/ish_policy b/data/delta/optiplex_5050sff/home/mca/ish_policy
+new file mode 100644
+index 0000000000000000000000000000000000000000..f76dd238ade08917e6712764a16a22005a50573d
+GIT binary patch
+literal 1
+IcmZPo000310RR91
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/optiplex_5050sff/home/mctp/device_ports b/data/delta/optiplex_5050sff/home/mctp/device_ports
+new file mode 100644
+index 0000000000000000000000000000000000000000..593f4708db84ac8fd0f5cc47c634f38c013fe9e4
+GIT binary patch
+literal 4
+LcmZQzU|;|M00aO5
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/optiplex_5050sff/home/policy/Bist/auto_config b/data/delta/optiplex_5050sff/home/policy/Bist/auto_config
+new file mode 100644
+index 0000000000000000000000000000000000000000..009d73a31973e2082917509b8596bb343d4265ab
+GIT binary patch
+literal 4
+LcmZQ<U|;|M0f+#C
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/optiplex_5050sff/home/policy/cfgmgr/cfg_rules b/data/delta/optiplex_5050sff/home/policy/cfgmgr/cfg_rules
+new file mode 100644
+index 0000000000000000000000000000000000000000..f78854b915d833ecdfdb5a53414ddaf51886a8b0
+GIT binary patch
+literal 660
+zcmY+>OHKko7zE%S9Y6^P<AXN{h%er#uqFcuD-%w@UEFvOF2<5ufK^Ei`CWACOQrko
+zNspOX)+|_r;WQy5>_TRDDI+Y9*(YU$rDXPLtQ%~luUvmEbH)Kfc`x|S=+1pk<{ZpB
+z_j#G$Rgiy?p?pH#$~=1~BkW%0o(Jcmb4ljevW&2b%)TmTkTsbz>vFW&e>db#5JgRy
+zXCIwgFy4soAGYP?=J?Zzd*qY6UTt?>8DY;dXTD&?@A;}8VQ(`3=Q~!sr{~<)9)t~?
+bht4CIXL;Ay^%Li*^M~`N^Oy6?dG7oNWyBYs
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/optiplex_5050sff/home/policy/hci/sysintid1 b/data/delta/optiplex_5050sff/home/policy/hci/sysintid1
+new file mode 100644
+index 0000000..62822c1
+--- /dev/null
++++ b/data/delta/optiplex_5050sff/home/policy/hci/sysintid1
+@@ -0,0 +1 @@
++Qó´
+\ No newline at end of file
+diff --git a/data/delta/optiplex_5050sff/home/policy/hci/sysintid2 b/data/delta/optiplex_5050sff/home/policy/hci/sysintid2
+new file mode 100644
+index 0000000..6f65ea4
+--- /dev/null
++++ b/data/delta/optiplex_5050sff/home/policy/hci/sysintid2
+@@ -0,0 +1 @@
++»[
+\ No newline at end of file
+diff --git a/data/delta/optiplex_5050sff/home/policy/hci/sysintid3 b/data/delta/optiplex_5050sff/home/policy/hci/sysintid3
+new file mode 100644
+index 0000000..43cfddc
+--- /dev/null
++++ b/data/delta/optiplex_5050sff/home/policy/hci/sysintid3
+@@ -0,0 +1 @@
++w“¯»
+\ No newline at end of file
+diff --git a/data/delta/optiplex_5050sff/home/policy/pwdmgr/segreto b/data/delta/optiplex_5050sff/home/policy/pwdmgr/segreto
+new file mode 100644
+index 0000000..61bb8a0
+--- /dev/null
++++ b/data/delta/optiplex_5050sff/home/policy/pwdmgr/segreto
+@@ -0,0 +1 @@
++̈Wß
+\ No newline at end of file
+-- 
+2.52.0
+
diff --git a/config/deguard/patches/0003-lib-image.py-Disable-FPT-checksum-check.patch b/config/deguard/patches/0003-lib-image.py-Disable-FPT-checksum-check.patch
new file mode 100644
index 00000000..42bb05c1
--- /dev/null
+++ b/config/deguard/patches/0003-lib-image.py-Disable-FPT-checksum-check.patch
@@ -0,0 +1,42 @@
+From 47c561cfa7b3970608543f8f2cb7d08b2d1e0e4d Mon Sep 17 00:00:00 2001
+From: Ron Nazarov <ron@noisytoot.org>
+Date: Sat, 14 Feb 2026 19:05:18 +0000
+Subject: [PATCH 3/4] lib/image.py: Disable $FPT checksum check
+
+I don't actually understand what this does, but it doesn't seem to be
+doing anything useful.  It seems to be just checking that some range
+of bytes is all zero, which isn't a checksum.
+
+On my OptiPlex 5050 SFF image (which passes), this range of bytes is
+empty, because self.data[self.HDRLEN_OFF] is 0.  On my Supermicro
+X11SSH-F/LN4F image, self.data[self.HDRLEN_OFF] is 19, which means
+that self.data[self.HEADER_OFF:self.data[self.HDRLEN_OFF]] is
+bytearray(b'$FP'), which makes the check fail.
+
+Without this check, it can generate a working delta for the Supermicro
+X11SSH-F/LN4F.
+
+Change-Id: I16735676fd4ae2a4e065886aeb7a06cead721cdf
+Signed-off-by: Ron Nazarov <ron@noisytoot.org>
+---
+ lib/image.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/image.py b/lib/image.py
+index 21db448..e303e8f 100644
+--- a/lib/image.py
++++ b/lib/image.py
+@@ -84,8 +84,8 @@ class MeImage:
+         # Verify magic and checksum
+         if self.data[self.MARKER_OFF:self.MARKER_OFF+4] != self.MARKER:
+             raise ValueError("Invalid $FPT magic")
+-        if sum(self.data[self.HEADER_OFF:self.data[self.HDRLEN_OFF]]) != 0:
+-            raise ValueError("Invalid $FPT checksum")
++        # if sum(self.data[self.HEADER_OFF:self.data[self.HDRLEN_OFF]]) != 0:
++        #     raise ValueError("Invalid $FPT checksum")
+ 
+         # Parse entries
+         self.entries = {}
+-- 
+2.52.0
+
diff --git a/config/deguard/patches/0004-data-delta-Add-Supermicro-X11SSH-F-LN4F.patch b/config/deguard/patches/0004-data-delta-Add-Supermicro-X11SSH-F-LN4F.patch
new file mode 100644
index 00000000..1df8e16b
--- /dev/null
+++ b/config/deguard/patches/0004-data-delta-Add-Supermicro-X11SSH-F-LN4F.patch
@@ -0,0 +1,280 @@
+From 6fd2bb708e69179768311215a6d724b30974ca13 Mon Sep 17 00:00:00 2001
+From: Ron Nazarov <ron@noisytoot.org>
+Date: Sat, 14 Feb 2026 19:07:27 +0000
+Subject: [PATCH 4/4] data/delta: Add Supermicro X11SSH-F/LN4F
+
+Obtained from the latest BIOS update downloadable from
+Supermicro's website:
+
+https://www.supermicro.com/Bios/softfiles/28700/X11SSH-(LN4)F_3.6_AS1.78_SUM2.14.0.zip
+
+Change-Id: I4a97e86b1e26f61fc90ea1b4709de84ac84e6005
+Signed-off-by: Ron Nazarov <ron@noisytoot.org>
+---
+ .../delta/supermicro_x11ssh-f/home/gpio/csme_pins | Bin 0 -> 20 bytes
+ data/delta/supermicro_x11ssh-f/home/icc/namestr   | Bin 0 -> 48 bytes
+ data/delta/supermicro_x11ssh-f/home/icc/prof0     | Bin 0 -> 24 bytes
+ .../delta/supermicro_x11ssh-f/home/mca/ish_policy | Bin 0 -> 1 bytes
+ data/delta/supermicro_x11ssh-f/home/mctp/eid_db   | Bin 0 -> 8 bytes
+ .../home/mon_serv/config/NmMsMgpio                |   1 +
+ .../supermicro_x11ssh-f/home/mon_serv/dev/BmcsCon | Bin 0 -> 73 bytes
+ .../supermicro_x11ssh-f/home/mon_serv/dev/PsusCon | Bin 0 -> 584 bytes
+ .../home/mon_serv/mondata/0000                    |   0
+ .../home/mon_serv/mondata/000a                    | Bin 0 -> 42 bytes
+ .../supermicro_x11ssh-f/home/mon_serv/pdt/0000    |   0
+ .../supermicro_x11ssh-f/home/nmdata/nm_presets    | Bin 0 -> 22 bytes
+ data/delta/supermicro_x11ssh-f/home/ptu/bmc_phase |   0
+ data/delta/supermicro_x11ssh-f/home/ptu/ign_phot  |   0
+ data/delta/supermicro_x11ssh-f/home/ptu/mfg_optin |   0
+ data/delta/supermicro_x11ssh-f/home/ptu/pwr_range |   0
+ data/delta/supermicro_x11ssh-f/home/ptu/verbose   |   0
+ data/delta/supermicro_x11ssh-f/home/sca/FWC       | Bin 0 -> 12 bytes
+ .../supermicro_x11ssh-f/home/sensors/sdr/SDR_0108 | Bin 0 -> 66 bytes
+ .../supermicro_x11ssh-f/home/sensors/sdr/SDR_0134 | Bin 0 -> 66 bytes
+ .../supermicro_x11ssh-f/home/sensors/sdr/SDR_014E |   0
+ .../supermicro_x11ssh-f/home/sensors/sdr/SDR_014F |   0
+ .../supermicro_x11ssh-f/home/sensors/sdr/SDR_0156 |   0
+ .../supermicro_x11ssh-f/home/sensors/sdr/SDR_0157 |   0
+ .../supermicro_x11ssh-f/home/sensors/sdr/SDR_01A4 |   0
+ .../supermicro_x11ssh-f/home/sensors/sdr/SDR_01A5 |   0
+ .../supermicro_x11ssh-f/home/sensors/sdr/SDR_0266 |   0
+ .../supermicro_x11ssh-f/home/sensors/sdr/SDR_0267 |   0
+ .../supermicro_x11ssh-f/home/sensors/sdr/SDR_02B2 |   0
+ .../supermicro_x11ssh-f/home/sku_mgr/sku_cfg      | Bin 0 -> 4 bytes
+ .../supermicro_x11ssh-f/home/trace/me_heartbeat   | Bin 0 -> 3 bytes
+ 31 files changed, 1 insertion(+)
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/gpio/csme_pins
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/icc/namestr
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/icc/prof0
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/mca/ish_policy
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/mctp/eid_db
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/mon_serv/config/NmMsMgpio
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/mon_serv/dev/BmcsCon
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/mon_serv/dev/PsusCon
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/mon_serv/mondata/0000
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/mon_serv/mondata/000a
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/mon_serv/pdt/0000
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/nmdata/nm_presets
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/ptu/bmc_phase
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/ptu/ign_phot
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/ptu/mfg_optin
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/ptu/pwr_range
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/ptu/verbose
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/sca/FWC
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0108
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0134
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_014E
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_014F
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0156
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0157
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_01A4
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_01A5
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0266
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0267
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_02B2
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/sku_mgr/sku_cfg
+ create mode 100644 data/delta/supermicro_x11ssh-f/home/trace/me_heartbeat
+
+diff --git a/data/delta/supermicro_x11ssh-f/home/gpio/csme_pins b/data/delta/supermicro_x11ssh-f/home/gpio/csme_pins
+new file mode 100644
+index 0000000000000000000000000000000000000000..f9641ea8dcaebaed9f318bc46afdbe3682c5a6c8
+GIT binary patch
+literal 20
+QcmZQzfB<12#Rz2s009616#xJL
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/supermicro_x11ssh-f/home/icc/namestr b/data/delta/supermicro_x11ssh-f/home/icc/namestr
+new file mode 100644
+index 0000000000000000000000000000000000000000..beaac121c8c24137a345ddc39f13d62618a3be5f
+GIT binary patch
+literal 48
+acmWG2%1_J8No7C>!6k`#DTzfX=;8ps`vwC5
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/supermicro_x11ssh-f/home/icc/prof0 b/data/delta/supermicro_x11ssh-f/home/icc/prof0
+new file mode 100644
+index 0000000000000000000000000000000000000000..6a2b6688abadc35203172633ecd226c215899b67
+GIT binary patch
+literal 24
+bcmWeozo*7wbe=&#T|k`y2sjuRK@<Z3G?@at
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/supermicro_x11ssh-f/home/mca/ish_policy b/data/delta/supermicro_x11ssh-f/home/mca/ish_policy
+new file mode 100644
+index 0000000000000000000000000000000000000000..f76dd238ade08917e6712764a16a22005a50573d
+GIT binary patch
+literal 1
+IcmZPo000310RR91
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/supermicro_x11ssh-f/home/mctp/eid_db b/data/delta/supermicro_x11ssh-f/home/mctp/eid_db
+new file mode 100644
+index 0000000000000000000000000000000000000000..f2e1ef249f4e61fb2d20cdc02ce8aea4ad217a8d
+GIT binary patch
+literal 8
+PcmY%3H(;2=z`y_i1la)c
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/supermicro_x11ssh-f/home/mon_serv/config/NmMsMgpio b/data/delta/supermicro_x11ssh-f/home/mon_serv/config/NmMsMgpio
+new file mode 100644
+index 0000000..8663f7d
+--- /dev/null
++++ b/data/delta/supermicro_x11ssh-f/home/mon_serv/config/NmMsMgpio
+@@ -0,0 +1 @@
++ÿÿÿÿÿÿÿÿ
+\ No newline at end of file
+diff --git a/data/delta/supermicro_x11ssh-f/home/mon_serv/dev/BmcsCon b/data/delta/supermicro_x11ssh-f/home/mon_serv/dev/BmcsCon
+new file mode 100644
+index 0000000000000000000000000000000000000000..b0524a4a8b2be02b17981db707914b46ea074652
+GIT binary patch
+literal 73
+ncmZQ%U|`^6@M2&D(pW(e!ybks496Mj84fcXVmO9X4M-3G%3=lC
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/supermicro_x11ssh-f/home/mon_serv/dev/PsusCon b/data/delta/supermicro_x11ssh-f/home/mon_serv/dev/PsusCon
+new file mode 100644
+index 0000000000000000000000000000000000000000..e9f219b891a05001e9b35fa6ad060526ae09dd4f
+GIT binary patch
+literal 584
+zcmZw9#|;886a>)Oz;00-=zttHg2aJL4Kzch1SCRb%h=1|OW(eDJk~s*KCz!LME{q#
+z+VF5hfDj9eQ5~M*Peso|?5C_9P>0aTLQ6~tHPu=aenlvALtR2=3$2h4YKfhSfq`;2
+z)FX7U&>AVBms*P=G*ID&`h>0)+8`tJ7CRLi1}fdqfY8lCTjYd3YAuS$KvOp~By_jX
+b4h5mF*r^yBXy%4SgdP^!qa-v}>$>;>ttBWC
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/supermicro_x11ssh-f/home/mon_serv/mondata/0000 b/data/delta/supermicro_x11ssh-f/home/mon_serv/mondata/0000
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/supermicro_x11ssh-f/home/mon_serv/mondata/000a b/data/delta/supermicro_x11ssh-f/home/mon_serv/mondata/000a
+new file mode 100644
+index 0000000000000000000000000000000000000000..80d189063372bd95b7a8bf26795f18a04caeef89
+GIT binary patch
+literal 42
+gcmd<$;$~1~;Ab#pFk;aCVD`b_gZ>B34-8l!00KV`mH+?%
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/supermicro_x11ssh-f/home/mon_serv/pdt/0000 b/data/delta/supermicro_x11ssh-f/home/mon_serv/pdt/0000
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/supermicro_x11ssh-f/home/nmdata/nm_presets b/data/delta/supermicro_x11ssh-f/home/nmdata/nm_presets
+new file mode 100644
+index 0000000000000000000000000000000000000000..66861c924bf4a8b1283afae028e71e00a8ad38a2
+GIT binary patch
+literal 22
+Ucmb1VNnwD2FN`2)!|;U>03@;mm;e9(
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/supermicro_x11ssh-f/home/ptu/bmc_phase b/data/delta/supermicro_x11ssh-f/home/ptu/bmc_phase
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/supermicro_x11ssh-f/home/ptu/ign_phot b/data/delta/supermicro_x11ssh-f/home/ptu/ign_phot
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/supermicro_x11ssh-f/home/ptu/mfg_optin b/data/delta/supermicro_x11ssh-f/home/ptu/mfg_optin
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/supermicro_x11ssh-f/home/ptu/pwr_range b/data/delta/supermicro_x11ssh-f/home/ptu/pwr_range
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/supermicro_x11ssh-f/home/ptu/verbose b/data/delta/supermicro_x11ssh-f/home/ptu/verbose
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/supermicro_x11ssh-f/home/sca/FWC b/data/delta/supermicro_x11ssh-f/home/sca/FWC
+new file mode 100644
+index 0000000000000000000000000000000000000000..ede1e388c36a3bd1b65fd6589cb0089518c66093
+GIT binary patch
+literal 12
+TcmWIb4(4KJU|`_2W?%pS3)TTi
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0108 b/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0108
+new file mode 100644
+index 0000000000000000000000000000000000000000..ce20a045414d7247199d1775c70110a503765617
+GIT binary patch
+literal 66
+zcmd;J;9v}7wANwZ&}DS}!N|w}1orj}KpMmhU|<gj=Bj5%iH~AnVr60i3S9_r_D~2(
+J%`H%X0st1B3CsWh
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0134 b/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0134
+new file mode 100644
+index 0000000000000000000000000000000000000000..5b2dd14b08fc108710b2c7b9453af1a3de26c0ee
+GIT binary patch
+literal 66
+ycmXqEFkuX2wANuTVP<gr!NbS^1orkI3d{s?85kPCB!sx&8xo@691v=t00jW)ya$~C
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_014E b/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_014E
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_014F b/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_014F
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0156 b/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0156
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0157 b/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0157
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_01A4 b/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_01A4
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_01A5 b/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_01A5
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0266 b/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0266
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0267 b/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_0267
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_02B2 b/data/delta/supermicro_x11ssh-f/home/sensors/sdr/SDR_02B2
+new file mode 100644
+index 0000000..e69de29
+diff --git a/data/delta/supermicro_x11ssh-f/home/sku_mgr/sku_cfg b/data/delta/supermicro_x11ssh-f/home/sku_mgr/sku_cfg
+new file mode 100644
+index 0000000000000000000000000000000000000000..79b07aac966f6048bcc8eef91b63eb76e313db68
+GIT binary patch
+literal 4
+Lcmd<JW?%pS0O<fp
+
+literal 0
+HcmV?d00001
+
+diff --git a/data/delta/supermicro_x11ssh-f/home/trace/me_heartbeat b/data/delta/supermicro_x11ssh-f/home/trace/me_heartbeat
+new file mode 100644
+index 0000000000000000000000000000000000000000..4227ca4e8736af63036e7457e2db376ddf7e5795
+GIT binary patch
+literal 3
+KcmZQzU;qFB0{{U4
+
+literal 0
+HcmV?d00001
+
+-- 
+2.52.0
+
diff --git a/config/ifd/supermicro-x11-lga1151-series/ifd b/config/ifd/supermicro-x11-lga1151-series/ifd
deleted file mode 100644
index 0c3746cc..00000000
--- a/config/ifd/supermicro-x11-lga1151-series/ifd
+++ /dev/null
diff --git a/config/ifd/supermicro_x11_lga1151_series/ifd b/config/ifd/supermicro_x11_lga1151_series/ifd
index 0c3746cc..3c6049dc 100644
--- a/config/ifd/supermicro_x11_lga1151_series/ifd
+++ b/config/ifd/supermicro_x11_lga1151_series/ifd
diff --git a/config/vendor/supermicro_x11_lga1151_series/pkg.cfg b/config/vendor/supermicro_x11_lga1151_series/pkg.cfg
index 9a08f4e0..94020fb9 100644
--- a/config/vendor/supermicro_x11_lga1151_series/pkg.cfg
+++ b/config/vendor/supermicro_x11_lga1151_series/pkg.cfg
@@ -1,10 +1,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
-DL_hash="42f52d61af5e958c4395208acb5b57c85071cf7c333c2a24083b9697fcf904cd053e176b4ac2c5868739a34aa228d48051f1f55930a79fd9adaa6f349d5427c1"
-DL_url="https://www.supermicro.com/Bios/softfiles/28700/X11SSH-(LN4)F_3.6_AS1.78_SUM2.14.0.zip"
-# TODO: Find a backup URL. It's not on web.archive.org because robots.txt disallows crawling /Bios/*.
-DL_url_bkup="https://www.supermicro.com/Bios/softfiles/28700/X11SSH-(LN4)F_3.6_AS1.78_SUM2.14.0.zip"
-ME_bin_hash="0bab3e9e53ccba7dd0f345e66dd04dc7d4a47acab5945ffbc9e32cb73765b5ad5a12b42bb7ec145c08bcf1ed76b4d57bf2752988190da62067e578359adfc1d8"
+DL_hash="976bbb1e625f64df276d8343757d910c88b8a781f953bc2c41a7dd15184ec70d55f8081de2a0aaa83cddb8e73bdc2df6288fde6e0897e4928c48ca4bb30bea2d"
+DL_url="https://download.asrock.com/BIOS/1151/H110M-DGS(7.30)ROM.zip"
+DL_url_bkup="https://web.archive.org/web/20230822134231/https://download.asrock.com/BIOS/1151/H110M-DGS(7.30)ROM.zip"
+ME_bin_hash="1f864e7c6517436185af2827f640ac00e85676bb25231b5686dcc20f3ec16985726897cd84aa11eb6286d009f3551fc78f7e038b1cb3388a920f8ca391165781"
 
 # for Fsp.fd, we don't rely on a download. Instead,
 # we copy from coreboot.git. The file is defined
@@ -15,5 +14,9 @@ FSPFD_hash="c500166a8553a80ba8db8b8185a896e0ae1562ea3c139e07acd9e7937baf8110ba74
 FSPM_bin_hash="b15712a53f4d16f36b384beb6dbb716c0b0924751d6ca1e229cd4b8c03aef9eda025c235af247e53dac94d94b79559623974d0d21c7f97e125d8ecc2c86bf03f"
 FSPS_bin_hash="64ac9f93e43efddc35931e168d6594c2b39fb5a0da863d22f2d000d7eacc0692b07ce89389cbb1c5b95ff9b2bba508c538e37d0e644fcab7b2cada773da65ce6"
 
-# No bootguard, no deguard required
-ME11bootguard="n"
+# No bootguard, but we use deguard to configure the ME anyway
+ME11bootguard="y"
+ME11delta="supermicro_x11ssh-f" # subdirectory under deguard's data/delta/
+ME11version="11.6.0.1126"
+ME11sku="2M"
+ME11pch="H"