From cd4302cb098557d3df7967090df48463b40fbbb4 Mon Sep 17 00:00:00 2001
From: Lukas Greve <please@refre.ch>
Date: Sat, 12 Sep 2026 20:09:16 +0200
Subject: [PATCH] fix: make intelcpu IOMMU %post layout-aware and idempotent

Anaconda always creates /etc/kernel/cmdline, even on GRUB+BLS installs, so
the previous if/else misdetected systemd-boot on GRUB systems: the IOMMU
arguments landed in /etc/kernel/cmdline after GRUB+BLS boot entries had
already been generated from it, and never reached the running kernel
(observed on thinkpad and nuc6i7kyb).

Instead of branching on one file, update every kernel-argument surface
idempotently, guarded by existence: /etc/kernel/cmdline (kernel-install
source for systemd-boot and GRUB+BLS future kernels), /etc/default/grub
(grub.cfg flows), and the options line of every already-generated
/boot/loader/entries/*.conf (same shape under both systemd-boot and
GRUB+BLS). Guard the nested=1 append as well.
---
 cook/ingredients/hypervisor/intelcpu.ks | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/cook/ingredients/hypervisor/intelcpu.ks b/cook/ingredients/hypervisor/intelcpu.ks
index 9790b0a..e2bd162 100644
--- a/cook/ingredients/hypervisor/intelcpu.ks
+++ b/cook/ingredients/hypervisor/intelcpu.ks
@@ -2,12 +2,27 @@
 
 %post --nochroot --log=/mnt/sysimage/root/hypervisor-intelcpu-post.log # Beginning of %post section. Those commands are executed outside the chroot environment. Logging is enabled to help with post-installation troubleshooting
 
-if [ -f /mnt/sysimage/etc/kernel/cmdline ]; then # systemd-boot: kernel arguments live in /etc/kernel/cmdline
-    grep -q "intel_iommu=on" /mnt/sysimage/etc/kernel/cmdline || sed -i 's/$/ intel_iommu=on iommu=pt rd.driver.pre=vfio-pci/' /mnt/sysimage/etc/kernel/cmdline # Append IOMMU arguments once
-else # GRUB: kernel arguments live in /etc/default/grub
-    sed -i 's/\(quiet\)/\1 intel_iommu=on iommu=pt rd.driver.pre=vfio-pci/i' /mnt/sysimage/etc/default/grub # Load kernel modules in GRUB.
+# Kernel arguments cannot be attached to a single canonical location at %post time:
+# anaconda always creates /etc/kernel/cmdline (kernel-install source for both
+# systemd-boot and GRUB+BLS layouts), but GRUB+BLS boot entries have already been
+# generated from it by the kernel package scriptlets, and non-BLS flows still read
+# /etc/default/grub. Update every surface idempotently, guarded by file existence.
+
+IOMMU_ARGS="intel_iommu=on iommu=pt rd.driver.pre=vfio-pci"
+
+if [ -f /mnt/sysimage/etc/kernel/cmdline ]; then # kernel-install source (systemd-boot now, GRUB+BLS for future kernels)
+    grep -q "intel_iommu=on" /mnt/sysimage/etc/kernel/cmdline || echo " $IOMMU_ARGS" >> /mnt/sysimage/etc/kernel/cmdline # Append IOMMU arguments once
 fi
 
-echo "options kvm_intel nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization on Intel CPUs
+if [ -f /mnt/sysimage/etc/default/grub ]; then # GRUB: arguments for grub.cfg-based boot flows
+    grep -q "intel_iommu=on" /mnt/sysimage/etc/default/grub || sed -i "s/\(quiet\)/\1 $IOMMU_ARGS/i" /mnt/sysimage/etc/default/grub # Append IOMMU arguments once
+fi
+
+for bls_entry in /mnt/sysimage/boot/loader/entries/*.conf; do # Already-generated boot entries share one "options" line shape
+    [ -e "$bls_entry" ] || continue # Nothing matched: the glob stays literal
+    grep -q "intel_iommu=on" "$bls_entry" || sed -i "s/^\(options .*\)/\1 $IOMMU_ARGS/" "$bls_entry" # Patch the options line of each entry once
+done
+
+grep -q "nested=1" /mnt/sysimage/etc/modprobe.d/kvm.conf 2>/dev/null || echo "options kvm_intel nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization on Intel CPUs, exactly once
 
 %end # End of the %post section