#!ipxe

set server 172.16.9.1

:menu
menu GE Aerospace PXE Boot Menu
item --gap --             ---- Windows Deployment ----
item winpe                Windows PE (Image Deployment)
item --gap --             ---- Drive Erase ----
item blancco              Blancco Drive Eraser
item blancco_debug        Blancco Drive Eraser (debug / SSH)
item --gap --             ---- Utilities ----
item clonezilla           Clonezilla Live (Disk Imaging)
item clonezilla32         Clonezilla Live 32-bit (XP-era PCs, forced)
item --gap --             Memory test: Dell PCs press F12 at power-on, Diagnostics
item --gap --             ----
item reboot               Reboot
item exit                 Exit to BIOS
choose --default winpe --timeout 30000 target && goto ${target}

:winpe
# iPXE 2.0 reads the firmware variable; older iPXE cannot (empty), so it
# warns as before. Secure Boot confirmed on: no warning, no wait.
iseq ${efi/SecureBoot:uint8} 1 && goto winpe_boot ||
iseq ${efi/SecureBoot:hex} 01 && goto winpe_boot ||
echo
echo   Secure Boot is OFF on this PC (or this iPXE cannot tell).
echo   (iPXE read SecureBoot as: [${efi/SecureBoot:hex}] [${efi/SecureBoot:uint8}])
echo   Windows deployment requires Secure Boot to be ENABLED.
echo   If you disabled it earlier, re-enable it in BIOS Setup now.
echo
prompt --timeout 5000 Press any key to continue (auto-boot in 5s)... && goto winpe_boot || goto winpe_boot

:winpe_boot
kernel http://${server}/win11/wimboot gui
initrd http://${server}/win11/EFI/Microsoft/Boot/boot.stl  EFI/Microsoft/Boot/Boot.stl
initrd http://${server}/win11/EFI/Microsoft/Boot/BCD       EFI/Microsoft/Boot/BCD
initrd http://${server}/win11/EFI/Boot/bootx64.efi         EFI/Boot/bootx64.efi
initrd http://${server}/win11/Boot/boot.sdi                Boot/boot.sdi
initrd http://${server}/win11/sources/boot.wim             sources/boot.wim
# A command that fails without || aborts the whole iPXE script (the PC
# drops to firmware with no explanation), so every boot line has one.
boot || goto winpe_failed

:winpe_failed
echo
echo Windows PE boot FAILED (see the error above).
echo Check that the PXE server is up and the win11 boot files are staged.
prompt Press any key to return to menu... && goto menu || goto menu

:clonezilla
# 64-bit CPUs (cpuid extended bit 29 = long mode) get the current Clonezilla;
# older 32-bit-only CPUs (Pentium 4 without EM64T, Pentium M, early Atom:
# many XP-era PCs) get the last 32-bit release. If this iPXE has no cpuid
# command the check fails and the 32-bit build is used, which also runs
# on 64-bit CPUs.
cpuid --ext 29 && goto clonezilla64 || goto clonezilla32

:clonezilla64
set base http://${server}/clonezilla
kernel ${base}/vmlinuz boot=live username=user union=overlay config components noswap edd=on nomodeset nodmraid locales= keyboard-layouts= ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no net.ifnames=0 nosplash noprompt fetch=${base}/filesystem.squashfs || goto secureboot_warn
initrd ${base}/initrd.img || goto boot_failed
# Secure Boot ON: Clonezilla runs a Debian-signed kernel, started through
# Debian's Microsoft-signed shim (from the Clonezilla release, staged as
# clonezilla/shimx64.efi by prepare-boot-tools.sh), the same way Blancco
# uses Ubuntu's. Its modules (usb-storage, uas, exfat) are signed by the
# same build key, so USB drives work. Without the shim command (legacy
# BIOS, old iPXE) the line fails harmlessly and the kernel boots directly.
shim ${base}/shimx64.efi ||
boot || goto secureboot_warn

:clonezilla32
# Clonezilla 3.2.0-5 i686 (the last 32-bit release; later ones are amd64
# only), for legacy-BIOS XP-era PCs. A UEFI PC is always 64-bit and its
# firmware cannot start a 32-bit kernel, so UEFI goes to the 64-bit build.
iseq ${platform} efi && goto clonezilla64 ||
set base http://${server}/clonezilla-i686
kernel ${base}/vmlinuz boot=live username=user union=overlay config components noswap edd=on nomodeset nodmraid locales= keyboard-layouts= ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no net.ifnames=0 nosplash noprompt fetch=${base}/filesystem.squashfs || goto boot_failed
initrd ${base}/initrd.img || goto boot_failed
boot || goto boot_failed

:blancco
iseq ${platform} pcbios && goto blancco_bios || goto blancco_efi

:blancco_bios
echo Loading Blancco for legacy BIOS (canonical)...
kernel http://${server}/blancco/vmlinuz-bde-linux initrd=initramfs-bde-linux.img,config.img,intel-ucode.img,amd-ucode.img quiet loglevel=3 archisobasedir=arch archiso_http_srv=http://${server}/blancco/ copytoram=y cow_spacesize=50% memtest=00 vmalloc=400M ip=dhcp libata.allow_tpm=1 modprobe.blacklist=btusb rd.udev.timeout=10 systemd.battery-check=0 || goto blancco_bios_failed
initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_bios_failed
initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_bios_failed
initrd --name config.img http://${server}/blancco/config.img || goto blancco_bios_failed
initrd --name initramfs-bde-linux.img http://${server}/blancco/initramfs-bde-linux.img || goto blancco_bios_failed
boot || goto blancco_bios_failed
:blancco_bios_failed
echo
echo Blancco BIOS boot FAILED.
prompt Press any key to return to menu... && goto menu

:blancco_debug
iseq ${platform} pcbios && goto blancco_bios ||
echo Loading Blancco UEFI (debug: verbose, SSH for root)...
kernel http://${server}/blancco/vmlinuz-ubuntu-70 initrd=kexec-initrd-70.img ip=dhcp nomodeset vga=normal console=tty0 i915.modeset=0 nouveau.modeset=0 modprobe.blacklist=nouveau,nvidiafb,nvidia,nvidia_drm,mei_me,btusb,dcdbas libata.allow_tpm=1 rd.udev.timeout=10 efi=noruntime usbcore.autosuspend=-1 pcie_aspm=off e1000e.IntMode=0 e1000e.eee_enable=0 consoleblank=0 systemd.battery-check=0 systemd.mask=suspend.target,sleep.target,hibernate.target,hybrid-sleep.target no_console_suspend mem_sleep_default=s2idle blancco.debug=1 || goto blancco_efi_grub
initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_efi_grub
initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_efi_grub
initrd --name kexec-initrd-70.img http://${server}/blancco/kexec-initrd-70.img || goto blancco_efi_grub
# Secure Boot ON: iPXE 2.0 starts the Canonical-signed kernel through
# Ubuntu's Microsoft-signed shim. Older iPXE has no shim command: the
# line fails harmlessly and the kernel boots directly (Secure Boot off).
shim http://${server}/blancco/shimx64.efi ||
boot || goto blancco_efi_grub

:blancco_efi
echo Loading Blancco UEFI (direct kernel)...
kernel http://${server}/blancco/vmlinuz-ubuntu-70 initrd=kexec-initrd-70.img ip=dhcp quiet loglevel=3 nomodeset vga=normal console=tty0 i915.modeset=0 nouveau.modeset=0 modprobe.blacklist=nouveau,nvidiafb,nvidia,nvidia_drm,mei_me,btusb,dcdbas libata.allow_tpm=1 rd.udev.timeout=10 efi=noruntime usbcore.autosuspend=-1 pcie_aspm=off e1000e.IntMode=0 e1000e.eee_enable=0 consoleblank=0 systemd.battery-check=0 systemd.mask=suspend.target,sleep.target,hibernate.target,hybrid-sleep.target no_console_suspend mem_sleep_default=s2idle || goto blancco_efi_grub
initrd --name intel-ucode.img http://${server}/blancco/intel-ucode.img || goto blancco_efi_grub
initrd --name amd-ucode.img http://${server}/blancco/amd-ucode.img || goto blancco_efi_grub
initrd --name kexec-initrd-70.img http://${server}/blancco/kexec-initrd-70.img || goto blancco_efi_grub
# Secure Boot ON: iPXE 2.0 starts the Canonical-signed kernel through
# Ubuntu's Microsoft-signed shim. Older iPXE has no shim command: the
# line fails harmlessly and the kernel boots directly (Secure Boot off).
shim http://${server}/blancco/shimx64.efi ||
boot || goto blancco_efi_grub
:blancco_efi_grub
echo Direct kernel boot failed - trying GRUB chain fallback...
chain http://${server}/blancco/grubx64.efi || goto secureboot_warn

:boot_failed
echo
echo Download FAILED (see the error above). Check the PXE server and retry.
prompt Press any key to return to menu... && goto menu || goto menu

:secureboot_warn
echo
echo ======================================================
echo   This option could not start with Secure Boot enabled.
echo
echo   1. Reboot this machine
echo   2. Press F2 / Del to enter BIOS Setup
echo   3. Disable Secure Boot
echo   4. Save and exit BIOS
echo   5. PXE boot again and select this option
echo
echo   Re-enable Secure Boot after completing the task.
echo ======================================================
echo
prompt Press any key to return to menu...
goto menu

:reboot
reboot

:exit
exit