#!ipxe set server 172.16.9.1 :menu menu GE Aerospace PXE Boot Menu item --gap -- ---- Windows Deployment ---- item winpe Windows PE (Image Deployment) item --gap -- ---- Drive Erase ---- item blancco Blancco Drive Eraser item blancco_debug Blancco Drive Eraser (debug / SSH) item --gap -- ---- Utilities (Secure Boot must be DISABLED) ---- item clonezilla Clonezilla Live (Disk Imaging) item memtest Memtest86+ (Memory Diagnostics) item --gap -- ---- item reboot Reboot item exit Exit to BIOS choose --default winpe --timeout 30000 target && goto ${target} :winpe # iPXE 2.0 reads the firmware variable; older iPXE cannot (empty), so it # warns as before. Secure Boot confirmed on: no warning, no wait. iseq ${efi/SecureBoot:uint8} 1 && goto winpe_boot || echo echo Secure Boot is OFF on this PC (or this iPXE cannot tell). echo Windows deployment requires Secure Boot to be ENABLED. echo If you disabled it for Clonezilla/Memtest, re-enable it now. echo prompt --timeout 5000 Press any key to continue (auto-boot in 5s)... && goto winpe_boot || goto winpe_boot :winpe_boot kernel http://${server}/win11/wimboot gui initrd http://${server}/win11/EFI/Microsoft/Boot/boot.stl EFI/Microsoft/Boot/Boot.stl initrd http://${server}/win11/EFI/Microsoft/Boot/BCD EFI/Microsoft/Boot/BCD initrd http://${server}/win11/EFI/Boot/bootx64.efi EFI/Boot/bootx64.efi initrd http://${server}/win11/Boot/boot.sdi Boot/boot.sdi initrd http://${server}/win11/sources/boot.wim sources/boot.wim boot :clonezilla set base http://${server}/clonezilla kernel ${base}/vmlinuz boot=live username=user union=overlay config components noswap edd=on nomodeset nodmraid locales= keyboard-layouts= ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no net.ifnames=0 nosplash noprompt fetch=${base}/filesystem.squashfs || goto secureboot_warn initrd ${base}/initrd.img boot :blancco iseq ${platform} pcbios && goto blancco_bios || goto blancco_efi :blancco_bios echo Loading Blancco for legacy BIOS (canonical)... kernel http://${server}/blancco/vmlinuz-bde-linux initrd=initramfs-bde-linux.img,config.img,intel-ucode.img,amd-ucode.img quiet loglevel=3 archisobasedir=arch archiso_http_srv=http://${server}/blancco/ copytoram=y cow_spacesize=50% memtest=00 vmalloc=400M ip=dhcp libata.allow_tpm=1 modprobe.blacklist=btusb rd.udev.timeout=10 systemd.battery-check=0 || goto blancco_bios_failed initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_bios_failed initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_bios_failed initrd --name config.img http://${server}/blancco/config.img || goto blancco_bios_failed initrd --name initramfs-bde-linux.img http://${server}/blancco/initramfs-bde-linux.img || goto blancco_bios_failed boot :blancco_bios_failed echo echo Blancco BIOS boot FAILED. prompt Press any key to return to menu... && goto menu :blancco_debug iseq ${platform} pcbios && goto blancco_bios || echo Loading Blancco UEFI (debug: verbose, SSH for root)... kernel http://${server}/blancco/vmlinuz-ubuntu-70 initrd=kexec-initrd-70.img ip=dhcp nomodeset vga=normal console=tty0 i915.modeset=0 nouveau.modeset=0 modprobe.blacklist=nouveau,nvidiafb,nvidia,nvidia_drm,mei_me,btusb,dcdbas libata.allow_tpm=1 rd.udev.timeout=10 efi=noruntime usbcore.autosuspend=-1 pcie_aspm=off e1000e.IntMode=0 e1000e.eee_enable=0 consoleblank=0 systemd.battery-check=0 systemd.mask=suspend.target,sleep.target,hibernate.target,hybrid-sleep.target no_console_suspend mem_sleep_default=s2idle blancco.debug=1 || goto blancco_efi_grub initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_efi_grub initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_efi_grub initrd --name kexec-initrd-70.img http://${server}/blancco/kexec-initrd-70.img || goto blancco_efi_grub # Secure Boot ON: iPXE 2.0 starts the Canonical-signed kernel through # Ubuntu's Microsoft-signed shim. Older iPXE has no shim command: the # line fails harmlessly and the kernel boots directly (Secure Boot off). shim http://${server}/blancco/shimx64.efi || boot || goto blancco_efi_grub :blancco_efi echo Loading Blancco UEFI (direct kernel)... kernel http://${server}/blancco/vmlinuz-ubuntu-70 initrd=kexec-initrd-70.img ip=dhcp quiet loglevel=3 nomodeset vga=normal console=tty0 i915.modeset=0 nouveau.modeset=0 modprobe.blacklist=nouveau,nvidiafb,nvidia,nvidia_drm,mei_me,btusb,dcdbas libata.allow_tpm=1 rd.udev.timeout=10 efi=noruntime usbcore.autosuspend=-1 pcie_aspm=off e1000e.IntMode=0 e1000e.eee_enable=0 consoleblank=0 systemd.battery-check=0 systemd.mask=suspend.target,sleep.target,hibernate.target,hybrid-sleep.target no_console_suspend mem_sleep_default=s2idle || goto blancco_efi_grub initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_efi_grub initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_efi_grub initrd --name kexec-initrd-70.img http://${server}/blancco/kexec-initrd-70.img || goto blancco_efi_grub # Secure Boot ON: iPXE 2.0 starts the Canonical-signed kernel through # Ubuntu's Microsoft-signed shim. Older iPXE has no shim command: the # line fails harmlessly and the kernel boots directly (Secure Boot off). shim http://${server}/blancco/shimx64.efi || boot || goto blancco_efi_grub :blancco_efi_grub echo Direct kernel boot failed - trying GRUB chain fallback... chain http://${server}/blancco/grubx64.efi || goto secureboot_warn :memtest kernel http://${server}/memtest/memtest.efi || goto secureboot_warn boot :secureboot_warn echo echo ====================================================== echo This option requires Secure Boot to be DISABLED. echo echo 1. Reboot this machine echo 2. Press F2 / Del to enter BIOS Setup echo 3. Disable Secure Boot echo 4. Save and exit BIOS echo 5. PXE boot again and select this option echo echo Re-enable Secure Boot after completing the task. echo ====================================================== echo prompt Press any key to return to menu... goto menu :reboot reboot :exit exit