boards: add Dell OptiPlex 9020 SFF support

Add a new board configuration for the Dell OptiPlex 9020 SFF, the first
Heads port for this hardware. The 9020 SFF is a Haswell + Lynx Point
desktop that shares its platform with the already-supported ThinkPad
T440p, but differs in the embedded controller (SMSC SCH555x) and uses
a two-chip 8 MB + 4 MB SPI layout.

Blob-minimized configuration:
- No MRC blob (uses Native RAM Initialization via CONFIG_USE_NATIVE_RAMINIT)
- No FSP (Haswell does not use it)
- Intel ME neutralized and soft-disabled via me_cleaner (-S -r -t -d),
  shrunk from 6 MB to ~120 KB (FTPR bring-up module only)
- IFD and GbE configuration blobs are extracted by each user from their
  own Dell BIOS backup (no third-party downloads)

Verified on hardware: coreboot builds cleanly, the Heads payload boots
to the GUI menu, and USB input works with CONFIG_USB_KEYBOARD_REQUIRED.

Files added:
- boards/dell-optiplex-9020-sff/dell-optiplex-9020-sff.config
- config/coreboot-dell-optiplex-9020-sff.config (derived from t440p)
- blobs/optiplex_9020/extract, README.md

Signed-off-by: Michael Gogiashvili <gogiaschvili@protonmail.com>

Author: MG3004

blobs/optiplex_9020/README.md

@@ -0,0 +1,65 @@
+# OptiPlex 9020 SFF Blobs
+
+- [Overview](#overview)
+- [Blob Strategy](#blob-strategy)
+- [Using Your Own Blobs](#using-your-own-blobs)
+
+## Overview
+
+Heads on the Dell OptiPlex 9020 SFF requires three small binary blobs, all
+extracted from the user's own Dell BIOS backup. **No proprietary code blobs
+are downloaded from third parties** — everything comes from your hardware.
+
+| Blob      | Size     | What it is                                                |
+|-----------|----------|-----------------------------------------------------------|
+| `ifd.bin` | 4 KB     | Intel Flash Descriptor (resized: ME shrunk, BIOS grown)   |
+| `me.bin`  | ~120 KB  | Intel ME, **neutralized + soft-disabled** via me_cleaner |
+| `gbe.bin` | 16 KB    | Intel Gigabit Ethernet config (incl. LAN MAC address)    |
+
+**Notably NOT required** (this is the blob-minimized setup):
+
+- `mrc.bin` — **eliminated**. Haswell native RAM initialization (NRI) is used
+  instead, via coreboot's `CONFIG_USE_NATIVE_RAMINIT=y`. No proprietary
+  memory-init blob.
+- FSP — Haswell does not use Intel Firmware Support Package.
+- Intel ME in full — only the ~120 KB FTPR bring-up module remains; all AMT,
+  networking, anti-theft and backdoor modules removed.
+
+## Blob Strategy
+
+The Intel ME on the 9020 (Lynx Point, ME 9.x) is **neutralized and
+soft-disabled** using [me_cleaner](https://github.com/corna/me_cleaner)
+with the flags `-S -r -t -d`:
+
+- `-S` sets the AltMeDisable bit (HAP) in PCHSTRP10 → ME disabled after boot
+- `-r` removes non-essential ME modules (TDT, FPF, HOSTCOMM, SESSMGR, ...)
+- `-t` truncates the ME region to the minimum bootable size (~120 KB)
+- `-d` additionally deactivates ME features
+
+Result: ME shrunk from 6 MB → ~120 KB, **98% reduction**. The remaining FTPR
+module is required for power/clock management during boot; it cannot be
+removed without bricking the board. The ME's RSA signature remains valid
+(verified by me_cleaner), so the board boots.
+
+> **Note on "completely removing" the ME:** The ME is physically present in
+> the Lynx Point PCH silicon. Software cannot remove hardware. me_cleaner's
+> neutralization is the maximum achievable on this platform.
+
+## Using Your Own Blobs
+
+If you have a different Dell 9020 SFF (or want to re-extract from a fresh
+backup), first build Heads at least once to download the coreboot sources,
+then run the extraction script:
+
+```console
+$ make BOARD=dell-optiplex-9020-sff          # downloads coreboot sources
+
+$ export COREBOOT_DIR="./build/x86/coreboot-25.09/"
+$ ./blobs/optiplex_9020/extract /path/to/original_dell_bios.bin ./blobs/optiplex_9020
+
+$ make BOARD=dell-optiplex-9020-sff          # rebuild with your blobs
+```
+
+The extraction script performs the same operations that produced the blobs
+shipped here. Your MAC address will differ; if you want anonymity, override
+it to `00:de:ad:c0:ff:ee` using [nvmutil](https://libreboot.org/docs/install/nvmutil.html).

blobs/optiplex_9020/extract

@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# =============================================================================
+# Extract Intel firmware blobs (IFD, ME, GbE) from an original Dell OptiPlex
+# 9020 SFF BIOS backup, and neutralize the Intel ME.
+#
+# Usage:  ./extract <path_to_original_rom.bin> <path_to_output_directory>
+#
+# Produces in the output directory:
+#   ifd.bin  - Intel Flash Descriptor (resized: ME region shrunk, BIOS grown)
+#   me.bin   - Intel ME firmware (neutralized + soft-disabled + truncated)
+#   gbe.bin  - Intel Gigabit Ethernet configuration (incl. LAN MAC address)
+#
+# Modelled on blobs/t440p/extract. Requires COREBOOT_DIR pointing at a built
+# coreboot source tree (for util/me_cleaner and util/ifdtool).
+# =============================================================================
+set -e
+
+function usage() {
+    echo -n \
+        "Usage: $(basename "$0") path_to_original_rom path_to_output_directory
+Extract Intel firmware from the original Dell OptiPlex 9020 SFF BIOS backup.
+Neutralizes the ME via me_cleaner (-S -r -t -d) and shrinks the IFD regions.
+"
+}
+
+if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+    if [[ "${1:-}" == "--help" ]]; then
+        usage
+    else
+        if [[ -z "${COREBOOT_DIR}" ]]; then
+            echo "ERROR: No COREBOOT_DIR variable defined."
+            echo "       Export COREBOOT_DIR=/path/to/built/coreboot source tree."
+            exit 1
+        fi
+
+        original_rom="$(realpath "$1")"
+        output_dir="$(realpath "${2:-./}")"
+
+        if [[ ! -f "${original_rom}" ]]; then
+            echo "ERROR: original ROM not found: ${original_rom}"
+            exit 1
+        fi
+
+        echo ">>> Source ROM: ${original_rom} ($(stat -c%s "${original_rom}") bytes)"
+        echo ">>> Output dir: ${output_dir}"
+        echo
+
+        # Step 1: Neutralize Intel ME + resize the IFD regions in one pass.
+        # Flags (same as t440p reference):
+        #   -S  soft-disable  (set AltMeDisable / HAP bit in PCHSTRP10)
+        #   -r  remove        (strip non-essential ME modules)
+        #   -t  truncate      (shrink ME region to minimum bootable size)
+        #   -d  deactivate    (additionally disable ME features)
+        #   -O  output full image (descriptor + neutered ME)
+        #   -D  output shrinked descriptor
+        #   -M  output truncated ME image
+        echo ">>> me_cleaner: neutralizing + soft-disabling Intel ME..."
+        pushd "${COREBOOT_DIR}/util/me_cleaner"
+
+        python me_cleaner.py -S -r -t -d \
+            -O out.bin \
+            -D ifd_shrinked.bin \
+            -M me_shrinked.bin \
+            "${original_rom}"
+
+        mv ifd_shrinked.bin "${output_dir}/ifd.bin"
+        mv me_shrinked.bin  "${output_dir}/me.bin"
+        rm -f ./*.bin
+
+        popd
+        echo "    -> ifd.bin ($(stat -c%s "${output_dir}/ifd.bin") bytes)"
+        echo "    -> me.bin  ($(stat -c%s "${output_dir}/me.bin") bytes)"
+
+        # Step 2: Extract the Intel Gigabit Ethernet (GbE) configuration blob
+        # (contains the LAN MAC address) using ifdtool.
+        echo ">>> ifdtool: extracting GbE configuration blob..."
+        pushd "${COREBOOT_DIR}/util/ifdtool"
+
+        make
+        ./ifdtool -x "${original_rom}"
+
+        mv flashregion_3_gbe.bin "${output_dir}/gbe.bin"
+        rm -f flashregion_*.bin
+
+        popd
+        echo "    -> gbe.bin ($(stat -c%s "${output_dir}/gbe.bin") bytes)"
+
+        echo
+        echo ">>> Done. Blobs in ${output_dir}:"
+        ls -la "${output_dir}"/ifd.bin "${output_dir}"/me.bin "${output_dir}"/gbe.bin
+    fi
+fi

boards/dell-optiplex-9020-sff/dell-optiplex-9020-sff.config

@@ -0,0 +1,129 @@
+# WARNING: This system remains perpetually vulnerable to Spectre v2 (CVE-2017-5715).
+# Mitigations and microcode updates previously applied are now known to be ineffective
+# due to QSB-107 and related CVEs. If Spectre v2 is a concern in your threat model,
+# consider migrating to a platform with ongoing microcode support. Proper OPSEC for
+# Memory Use MUST be followed:
+# https://www.anarsec.guide/posts/qubes/#appendix-opsec-for-memory-use
+#
+# Configuration for a Dell OptiPlex 9020 SFF running Qubes OS and other
+# Linux-based OSes through kexec.
+#
+# Hardware specifications:
+# - CPU: LGA 1150, Intel Haswell (4th Gen) -- Celeron/Pentium/Core i3/i5/i7,
+#   up to Core i7-4790 (4C/8T, 3.6 GHz base / 4.0 GHz boost)
+# - Chipset: Intel Q87 Express (Lynx Point)
+# - RAM: 2x DDR3-1600 UDIMM, up to 16 GB per slot (32 GB max), dual-channel
+# - Storage: 2x SATA 6 Gb/s; NVMe via PCIe adapter in x16 slot
+# - PCIe: 1x PCIe 3.0 x16, 1x PCIe 3.0 x1 (half-height SFF brackets)
+# - Video: 1x VGA + 1x DisplayPort 1.2 (Intel HD Graphics 4600, Haswell GT2)
+# - Ethernet: Intel I217-LM Gigabit
+# - Audio: Realtek ALC3221 HD Audio
+# - TPM: Infineon TPM 1.2 (soldered, supports measured boot)
+# - Form factor: Small Form Factor (SFF)
+#
+# Platform notes (vs. the t440p reference, which is also Haswell + Lynx Point):
+# - Northbridge/southbridge/CPU/ME: identical to t440p
+# - Embedded Controller: SMSC SCH555x (Dell) instead of Lenovo H8/EC
+# - Super I/O handled by the same sch555x driver
+# - SATA port map: 0x33 (ports 0 and 5 active on SFF)
+# - VGA BIOS ID: Haswell GT2 desktop variant
+# - ROM: 12 MB split into an 8 MB bottom chip and a 4 MB top chip
+#
+# Blob strategy (blob-minimized):
+# - MRC blob: none. Uses Native RAM Initialization (CONFIG_USE_NATIVE_RAMINIT).
+# - FSP: none. Haswell does not use Intel Firmware Support Package.
+# - Intel ME: neutralized and soft-disabled via me_cleaner (-S -r -t -d).
+#   AltMeDisable bit set in PCHSTRP10. ME shrunk from 6 MB to ~120 KB.
+#   Only the bring-up module (FTPR) remains; all AMT/networking/backdoor
+#   modules (TDT, FPF, HOSTCOMM, SESSMGR, ...) removed.
+# - IFD/GbE: small configuration blobs (4 KB / 16 KB), not executable firmware.
+#   Each user extracts these from their own Dell BIOS backup.
+
+# Coreboot + Linux versions (match the t440p reference for Haswell)
+export CONFIG_COREBOOT=y
+export CONFIG_COREBOOT_VERSION=25.09
+export CONFIG_LINUX_VERSION=6.1.8
+
+CONFIG_COREBOOT_CONFIG=config/coreboot-dell-optiplex-9020-sff.config
+CONFIG_LINUX_CONFIG=config/linux-t440p.config
+
+# --- Blob handling -----------------------------------------------------------
+# The Coreboot build depends on the three blobs extracted from the Dell BIOS
+# backup: ifd.bin (resized descriptor), me.bin (neutralized ME), gbe.bin.
+$(build)/coreboot-$(CONFIG_COREBOOT_VERSION)/$(BOARD)/.build: \
+    $(pwd)/blobs/optiplex_9020/ifd.bin \
+    $(pwd)/blobs/optiplex_9020/me.bin \
+    $(pwd)/blobs/optiplex_9020/gbe.bin
+
+# When the blobs are missing, run the extract script to pull IFD/ME/GbE out
+# of the original Dell BIOS backup and neutralize the ME.
+$(pwd)/blobs/optiplex_9020/ifd.bin $(pwd)/blobs/optiplex_9020/me.bin $(pwd)/blobs/optiplex_9020/gbe.bin:
+	COREBOOT_DIR="$(build)/$(coreboot_base_dir)" \
+		$(pwd)/blobs/optiplex_9020/extract "$(pwd)/blobs/optiplex_9020/original_dell_bios.bin" "$(pwd)/blobs/optiplex_9020"
+
+# --- Modules packed into tools.cpio ------------------------------------------
+CONFIG_CRYPTSETUP2=y
+CONFIG_FLASHPROG=y
+CONFIG_FLASHTOOLS=y
+CONFIG_GPG2=y
+CONFIG_KEXEC=y
+CONFIG_UTIL_LINUX=y
+CONFIG_LVM2=y
+CONFIG_MBEDTLS=y
+CONFIG_PCIUTILS=y
+
+# --- Remote attestation support (TPM 1.2) ------------------------------------
+export CONFIG_TPM=y
+CONFIG_POPT=y
+CONFIG_QRENCODE=y
+CONFIG_TPMTOTP=y
+# HOTP-based remote attestation for a USB security dongle
+# (Nitrokey Pro 2 / Librem Key). Enable in a -hotp-maximized variant.
+#CONFIG_HOTPKEY=y
+
+# --- Platform locking finalization (PR0) -------------------------------------
+# Prevents SPI from being writeable outside of Heads.
+CONFIG_IO386=y
+export CONFIG_FINALIZE_PLATFORM_LOCKING=y
+
+# --- GUI Support (FBWhiptail-based, graphical) -------------------------------
+CONFIG_CAIRO=y
+CONFIG_FBWHIPTAIL=y
+
+# --- Additional hardware support for the Linux payload -----------------------
+# USB support is mandatory on this board: it has no built-in keyboard.
+# CONFIG_USB_KEYBOARD_REQUIRED forces the xHCI/EHCI/HID drivers to be built
+# into the kernel (=y) rather than as loadable modules (=m), so they are
+# available immediately at boot -- before the initrd runs. Without this, USB
+# keyboards and mice (including wireless dongles) are dead in the Heads menu.
+export CONFIG_USB_KEYBOARD_REQUIRED=y
+CONFIG_LINUX_USB=y
+CONFIG_LINUX_E1000E=y
+CONFIG_MOBILE_TETHERING=y
+
+# --- Additional tools (tools.cpio) -------------------------------------------
+# SSH server (requires ethernet drivers, e.g. CONFIG_LINUX_E1000E above)
+CONFIG_DROPBEAR=y
+
+# --- Runtime configuration ---------------------------------------------------
+export CONFIG_AUTO_BOOT_TIMEOUT=5
+export CONFIG_DEBUG_OUTPUT=n
+export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=n
+export CONFIG_TPM2_CAPTURE_PCAP=n
+export CONFIG_QUIET_MODE=y
+export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
+export CONFIG_BOOT_REQ_HASH=n
+export CONFIG_BOOT_REQ_ROLLBACK=n
+# Kernel cmdline tweaks for the Heads payload kernel (not the target OS kernel)
+export CONFIG_BOOT_KERNEL_ADD=""
+export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
+# Default boot device; adjust to the target OS installation.
+export CONFIG_BOOT_DEV="/dev/sda1"
+export CONFIG_BOARD_NAME="Dell OptiPlex 9020 SFF"
+export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
+
+# --- Board targets -----------------------------------------------------------
+# The 9020 SFF uses two SPI chips: an 8 MB bottom chip (IFD + ME + part of
+# coreboot) and a 4 MB top chip (rest of coreboot + reset vector). The build
+# produces two files: *-bottom.rom and *-top.rom.
+BOARD_TARGETS += split_8mb4mb