boards: add Dell OptiPlex 9020 SFF support

[MG3004]

Summary

Adds the first Heads board configuration for the Dell OptiPlex 9020 SFF, a
Haswell + Lynx Point desktop that shares its platform with the already-supported
ThinkPad T440p but differs in the embedded controller (SMSC SCH555x) and uses
a two-chip 8 MB + 4 MB SPI layout.

Hardware

• CPU: LGA 1150, Intel Haswell (4th Gen), up to Core i7-4790
• Chipset: Intel Q87 Express (Lynx Point)
• RAM: 2x DDR3-1600 UDIMM, up to 32 GB
• Storage: 2x SATA 6 Gb/s; NVMe via PCIe adapter
• Video: Intel HD Graphics 4600 (VGA + DisplayPort)
• Ethernet: Intel I217-LM
• TPM: Infineon TPM 1.2 (soldered)

Blob strategy (blob-minimized)

• No MRC blob — uses Native RAM Initialization (CONFIG_USE_NATIVE_RAMINIT)
• No FSP — Haswell does not use it
• Intel ME neutralized and soft-disabled via me_cleaner (-S -r -t -d),
  shrunk from 6 MB to ~120 KB (FTPR bring-up module only)
• IFD/GbE configuration blobs are extracted by each user from their own
  Dell BIOS backup (no third-party downloads)

Files added

• boards/dell-optiplex-9020-sff/dell-optiplex-9020-sff.config
• config/coreboot-dell-optiplex-9020-sff.config (derived from t440p)
• blobs/optiplex_9020/extract, README.md, .gitignore

Status

DRAFT — work in progress.

Verified on hardware:

• Coreboot builds cleanly
• Heads payload boots to the GUI menu
• USB input works (CONFIG_USB_KEYBOARD_REQUIRED=y)
• OS boot via kexec (testing)
• HOTP/Nitrokey attestation (planned)

How to test

# Build (requires Docker, see doc/docker.md)
./docker_repro.sh make BOARD=dell-optiplex-9020-sff

# Extract blobs from your own Dell BIOS backup
export COREBOOT_DIR=./build/x86/coreboot-25.09/
./blobs/optiplex_9020/extract original_dell_bios.bin ./blobs/optiplex_9020

# Rebuild with your blobs
./docker_repro.sh make BOARD=dell-optiplex-9020-sff

[tlaurion]

@MG3004 Thank you for your contribution!!!

A small problem though, all boards under Heads provide IFD and GBE, GBE either generated or modified in tree to from a donor board, and blob download+ extraction recipes so ME can be stitched in directly from build time.

Is there an exe from Dell from which ME can be downloaded, extracted, neutered from? Have you looked into optiplex blobs scripts as a starting point?

[tlaurion]

when done, please add an entry under .circleci/config.yml to verify heads can build board with all blobs available.
the blobs should be added into the blbos build step so Circleci doesn't download them unless they changed, and the board be a duplicate of any 25.09 board build that is not seeding (example t440p)

[MG3004]

Hi @tlaurion — thanks for the feedback! Both requests are now implemented:

1. Downloadable ME (not user-extracted): Added blobs/optiplex_9020/download-clean-me which downloads the public Lenovo installer glrg22ww.exe (same source as t440p, since ME firmware is platform-generic for Lynx Point) and runs me_cleaner -r -t with a pinned ME_BIN_HASH verify step. IFD and GbE are now committed in-tree (anonymized MAC 00:de:ad:c0:ff:ee). The extract script is retained as a fallback path for users who want to preserve their original LAN MAC.
2. CircleCI entry: Added a build job for dell-optiplex-9020-sff in .circleci/config.yml, depending on EOL_t480-hotp-maximized [seed:coreboot-25.09], modeled on the t440p pattern (non-seeding job reusing the built coreboot-25.09 seed). All three blobs are available at build time (ifd.bin/gbe.bin in-tree, me.bin via download-clean-me triggered by the Makefile rule).
3. Dropbear: After rebasing onto origin/master (8d0064f, PR boards: comment out CONFIG_DROPBEAR on all board configs #2157), CONFIG_DROPBEAR=y has been commented out in the board config to follow the project-wide convention.