boards: dell-optiplex-9020-sff: switch to downloadable ME and add CircleCI entry

Per PR review feedback (#2152):

1. Ship IFD and GbE blobs in-tree (anonymized MAC 00:de:ad:c0:ff:ee),
   replacing per-user BIOS extraction as the default path.
2. Add download-clean-me script that downloads the public Lenovo
   installer glrg22ww.exe (same source as t440p, since ME firmware is
   platform-generic for Lynx Point) and runs me_cleaner -r -t with a
   pinned ME_BIN_HASH verify step.
3. Add CircleCI build job for dell-optiplex-9020-sff as a non-seeding
   25.09 board modeled on t440p (depends on the coreboot-25.09 seed).
4. Regenerate hashes.txt against the new in-tree ifd.bin/gbe.bin.
5. Update README and board config to document the new blob flow.

The extract script is retained as a fallback path for users who want
to preserve their original LAN MAC via their own Dell BIOS backup.

Signed-off-by: Michael Gogiashvili <gogiaschvili@protonmail.com>

Author: MG3004

.circleci/config.yml

@@ -528,6 +528,13 @@ workflows:
             - x86-musl-cross-make [cross compiler]
 
       # ── coreboot 25.09 boards (alphabetical) ───────────────────────────────
+      - build:
+          name: dell-optiplex-9020-sff
+          target: dell-optiplex-9020-sff
+          subcommand: ""
+          requires:
+            - EOL_t480-hotp-maximized [seed:coreboot-25.09]
+
       - build:
           name: EOL_m900_tower-hotp-maximized
           target: EOL_m900_tower-hotp-maximized

blobs/optiplex_9020/.gitignore

@@ -0,0 +1,5 @@
+# me.bin is downloaded and neutralized on demand by download-clean-me.
+# original_dell_bios.bin is the user's private BIOS backup (if they use the
+# extract script instead). Neither should be committed.
+me.bin
+original_dell_bios.bin

blobs/optiplex_9020/README.md

@@ -2,54 +2,72 @@
 
 - [Overview](#overview)
 - [Blob Strategy](#blob-strategy)
+- [Building with Default Blobs](#building-with-default-blobs)
 - [Using Your Own Blobs](#using-your-own-blobs)
 
 ## Overview
 
-Heads on the Dell OptiPlex 9020 SFF requires three small binary blobs, all
-extracted from the user's own Dell BIOS backup. **No proprietary code blobs
-are downloaded from third parties** — everything comes from your hardware.
+Heads on the Dell OptiPlex 9020 SFF requires three small binary blobs:
 
-| Blob      | Size     | What it is                                                |
-|-----------|----------|-----------------------------------------------------------|
-| `ifd.bin` | 4 KB     | Intel Flash Descriptor (resized: ME shrunk, BIOS grown)   |
-| `me.bin`  | ~120 KB  | Intel ME, **neutralized + soft-disabled** via me_cleaner |
-| `gbe.bin` | 16 KB    | Intel Gigabit Ethernet config (incl. LAN MAC address)    |
+| Blob      | Size     | Source                                                   |
+|-----------|----------|----------------------------------------------------------|
+| `ifd.bin` | 4 KB     | Intel Flash Descriptor, shipped in-tree (anonymized)     |
+| `me.bin`  | ~120 KB  | Intel ME, downloaded and neutralized by `download-clean-me` |
+| `gbe.bin` | 8 KB     | Intel Gigabit Ethernet config, shipped in-tree (anonymized MAC) |
 
-**Notably NOT required** (this is the blob-minimized setup):
+`ifd.bin` and `gbe.bin` are committed to the repository directly. They contain
+no personal data: the GbE MAC is set to the anonymized `00:de:ad:c0:ff:ee`,
+matching the convention used by other Heads boards. The IFD has its ME region
+shrunk and BIOS region expanded, ready for a neutralized ME.
 
-- `mrc.bin` — **eliminated**. Haswell native RAM initialization (NRI) is used
-  instead, via coreboot's `CONFIG_USE_NATIVE_RAMINIT=y`. No proprietary
-  memory-init blob.
-- FSP — Haswell does not use Intel Firmware Support Package.
-- Intel ME in full — only the ~120 KB FTPR bring-up module remains; all AMT,
-  networking, anti-theft and backdoor modules removed.
+`me.bin` is the only blob that is **not** committed (it is proprietary Intel
+firmware). It is downloaded on demand from the public Lenovo installer
+`glrg22ww.exe` -- the same source used by the t440p -- because the ME firmware
+is platform-generic for Lynx Point, not vendor-specific.
 
 ## Blob Strategy
 
-The Intel ME on the 9020 (Lynx Point, ME 9.x) is **neutralized and
-soft-disabled** using [me_cleaner](https://github.com/corna/me_cleaner)
-with the flags `-S -r -t -d`:
+The Intel ME on the 9020 (Lynx Point, ME 9.x) is **neutralized and shrunk**
+using [me_cleaner](https://github.com/corna/me_cleaner) with the flags
+`-r -t`:
 
-- `-S` sets the AltMeDisable bit (HAP) in PCHSTRP10 → ME disabled after boot
 - `-r` removes non-essential ME modules (TDT, FPF, HOSTCOMM, SESSMGR, ...)
 - `-t` truncates the ME region to the minimum bootable size (~120 KB)
-- `-d` additionally deactivates ME features
 
-Result: ME shrunk from 6 MB → ~120 KB, **98% reduction**. The remaining FTPR
-module is required for power/clock management during boot; it cannot be
-removed without bricking the board. The ME's RSA signature remains valid
-(verified by me_cleaner), so the board boots.
+Result: ME shrunk from 5 MB to ~120 KB. The remaining FTPR module is required
+for power/clock management during boot; it cannot be removed without bricking
+the board. The ME's RSA signature remains valid (verified by me_cleaner), so
+the board boots.
+
+**Notably NOT required** (this is the blob-minimized setup):
+
+- `mrc.bin` -- eliminated. Haswell native RAM initialization (NRI) is used
+  instead, via coreboot's `CONFIG_USE_NATIVE_RAMINIT=y`.
+- FSP -- Haswell does not use Intel Firmware Support Package.
+- Intel ME in full -- only the ~120 KB FTPR bring-up module remains; all AMT,
+  networking, anti-theft and backdoor modules removed.
 
 > **Note on "completely removing" the ME:** The ME is physically present in
 > the Lynx Point PCH silicon. Software cannot remove hardware. me_cleaner's
 > neutralization is the maximum achievable on this platform.
 
+## Building with Default Blobs
+
+The standard build path downloads and neutralizes the ME automatically:
+
+```console
+$ make BOARD=dell-optiplex-9020-sff
+```
+
+The build system invokes `download-clean-me` to fetch the Lenovo installer,
+extract `ME9.1_5M_Production.bin`, and run me_cleaner. No manual steps
+required.
+
 ## Using Your Own Blobs
 
-If you have a different Dell 9020 SFF (or want to re-extract from a fresh
-backup), first build Heads at least once to download the coreboot sources,
-then run the extraction script:
+If you prefer to extract the blobs from your own Dell BIOS backup (for
+example, to preserve your original LAN MAC address), build Heads once to
+download the coreboot sources, then run the extraction script:
 
 ```console
 $ make BOARD=dell-optiplex-9020-sff          # downloads coreboot sources
@@ -60,6 +78,6 @@ $ ./blobs/optiplex_9020/extract /path/to/original_dell_bios.bin ./blobs/optiplex
 $ make BOARD=dell-optiplex-9020-sff          # rebuild with your blobs
 ```
 
-The extraction script performs the same operations that produced the blobs
-shipped here. Your MAC address will differ; if you want anonymity, override
-it to `00:de:ad:c0:ff:ee` using [nvmutil](https://libreboot.org/docs/install/nvmutil.html).
+The extraction script performs a more aggressive neutralization
+(`me_cleaner -S -r -t -d`, including soft-disable via the AltMeDisable/HAP
+bit) and preserves your hardware's original MAC address.

blobs/optiplex_9020/download-clean-me

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# =============================================================================
+# Download Intel ME firmware for the Dell OptiPlex 9020 SFF, neutralize it,
+# and shrink it to the minimum bootable size.
+#
+# The 9020 SFF is a Haswell + Lynx Point platform (Intel ME 9.1). It shares
+# the same ME firmware generation as the ThinkPad T440p, so this script
+# reuses the publicly available Lenovo installer (glrg22ww.exe) as the ME
+# source. The ME firmware is platform-generic for Lynx Point, not
+# vendor-specific.
+#
+# Usage:  ./download-clean-me <path_to_output_directory>
+#
+# Requires COREBOOT_DIR pointing at a built coreboot source tree (for
+# util/me_cleaner) and the innoextract tool.
+# =============================================================================
+set -e
+
+function usage() {
+    echo -n \
+        "Usage: $(basename "$0") path_to_output_directory
+Download Intel ME firmware from Lenovo, neutralize, and shrink.
+"
+}
+
+# Expected SHA256 of the resulting neutralized me.bin.
+# Sourced from the Lenovo glrg22ww.exe installer (same as the t440p).
+ME_BIN_HASH="b7cf4c0cf514bbf279d9fddb12c34fca5c1c23e94b000c26275369b924ab9c25"
+
+if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+    if [[ "${1:-}" == "--help" ]]; then
+        usage
+    else
+        if [[ -z "${COREBOOT_DIR}" ]]; then
+            echo "ERROR: No COREBOOT_DIR variable defined."
+            exit 1
+        fi
+
+        output_dir="$(realpath "${1:-./}")"
+
+        if [[ ! -f "${output_dir}/me.bin" ]]; then
+            # Unpack Lenovo's Windows installer into a temporary directory and
+            # extract the Intel ME blob.
+            pushd "$(mktemp -d)"
+
+            curl -O https://download.lenovo.com/pccbbs/mobiles/glrg22ww.exe
+            innoextract glrg22ww.exe
+
+            mv app/ME9.1_5M_Production.bin "${COREBOOT_DIR}/util/me_cleaner"
+
+            popd
+
+            # Neutralize and shrink Intel ME. Note that this doesn't include
+            # --soft-disable to set the "ME Disable" or "ME Disable B" (e.g.,
+            # High Assurance Program) bits, as they are defined within the Flash
+            # Descriptor.
+            # https://github.com/corna/me_cleaner/wiki/External-flashing#neutralize-and-shrink-intel-me-useful-only-for-coreboot
+            pushd "${COREBOOT_DIR}/util/me_cleaner"
+
+            python me_cleaner.py -r -t -O me_shrinked.bin ME9.1_5M_Production.bin
+
+            mv me_shrinked.bin "${output_dir}/me.bin"
+            rm ./*.bin
+
+            popd
+        fi
+
+        if ! echo "${ME_BIN_HASH} ${output_dir}/me.bin" | sha256sum --check; then
+            echo "ERROR: SHA256 checksum for me.bin doesn't match."
+            exit 1
+        fi
+    fi
+fi

blobs/optiplex_9020/gbe.bin

@@ -0,0 +1,2 @@
+4bbe2955e5b417fda53b29da8a864ae726de79af2629991ead1ee24536d6de1a  ifd.bin
+fa6baa411b46272b7398940d7edf2864742b94967205f9dea15f8772b766acc3  gbe.bin

blobs/optiplex_9020/hashes.txt

@@ -48,18 +48,20 @@ CONFIG_COREBOOT_CONFIG=config/coreboot-dell-optiplex-9020-sff.config
 CONFIG_LINUX_CONFIG=config/linux-t440p.config
 
 # --- Blob handling -----------------------------------------------------------
-# The Coreboot build depends on the three blobs extracted from the Dell BIOS
-# backup: ifd.bin (resized descriptor), me.bin (neutralized ME), gbe.bin.
+# The Coreboot build depends on the three blobs: ifd.bin (resized descriptor),
+# me.bin (neutralized ME), gbe.bin. ifd.bin and gbe.bin are shipped in-tree
+# (anonymized, no personal data). me.bin is downloaded and neutralized on
+# demand from the Lenovo installer, the same source used by the t440p (the ME
+# firmware is platform-generic for Lynx Point, not vendor-specific).
 $(build)/coreboot-$(CONFIG_COREBOOT_VERSION)/$(BOARD)/.build: \
     $(pwd)/blobs/optiplex_9020/ifd.bin \
     $(pwd)/blobs/optiplex_9020/me.bin \
     $(pwd)/blobs/optiplex_9020/gbe.bin
 
-# When the blobs are missing, run the extract script to pull IFD/ME/GbE out
-# of the original Dell BIOS backup and neutralize the ME.
-$(pwd)/blobs/optiplex_9020/ifd.bin $(pwd)/blobs/optiplex_9020/me.bin $(pwd)/blobs/optiplex_9020/gbe.bin:
+# When me.bin is missing, download and neutralize it from the Lenovo installer.
+$(pwd)/blobs/optiplex_9020/me.bin:
 	COREBOOT_DIR="$(build)/$(coreboot_base_dir)" \
-		$(pwd)/blobs/optiplex_9020/extract "$(pwd)/blobs/optiplex_9020/original_dell_bios.bin" "$(pwd)/blobs/optiplex_9020"
+		$(pwd)/blobs/optiplex_9020/download-clean-me $(pwd)/blobs/optiplex_9020
 
 # --- Modules packed into tools.cpio ------------------------------------------
 CONFIG_CRYPTSETUP2=y