fix: make amdcpu IOMMU %post layout-aware and idempotent

Same fix as cd4302c for intelcpu: the bare sed against /etc/default/grub
missed systemd-boot and already-generated GRUB+BLS boot entries. Update
every kernel-argument surface idempotently, guarded by file existence:
/etc/kernel/cmdline, /etc/default/grub, and the options line of every
/boot/loader/entries/*.conf. Guard the nested=1 append as well.

cook/ingredients/hypervisor/amdcpu.ks

@@ -2,8 +2,27 @@
 
 %post --nochroot --log=/mnt/sysimage/root/hypervisor-amdcpu-post.log # Beginning of %post section. Those commands are executed outside the chroot environment. Logging is enabled to help with post-installation troubleshooting
 
-sed -i 's/\(quiet\)/\1 iommu=pt rd.driver.pre=vfio-pci/i' /mnt/sysimage/etc/default/grub # Load kernel modules in GRUB. 
+# Kernel arguments cannot be attached to a single canonical location at %post time:
+# anaconda always creates /etc/kernel/cmdline (kernel-install source for both
+# systemd-boot and GRUB+BLS layouts), but GRUB+BLS boot entries have already been
+# generated from it by the kernel package scriptlets, and non-BLS flows still read
+# /etc/default/grub. Update every surface idempotently, guarded by file existence.
 
-echo "options kvm_amd nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization
+IOMMU_ARGS="iommu=pt rd.driver.pre=vfio-pci"
+
+if [ -f /mnt/sysimage/etc/kernel/cmdline ]; then # kernel-install source (systemd-boot now, GRUB+BLS for future kernels)
+    grep -q "iommu=pt" /mnt/sysimage/etc/kernel/cmdline || echo " $IOMMU_ARGS" >> /mnt/sysimage/etc/kernel/cmdline # Append IOMMU arguments once
+fi
+
+if [ -f /mnt/sysimage/etc/default/grub ]; then # GRUB: arguments for grub.cfg-based boot flows
+    grep -q "iommu=pt" /mnt/sysimage/etc/default/grub || sed -i "s/\(quiet\)/\1 $IOMMU_ARGS/i" /mnt/sysimage/etc/default/grub # Append IOMMU arguments once
+fi
+
+for bls_entry in /mnt/sysimage/boot/loader/entries/*.conf; do # Already-generated boot entries share one "options" line shape
+    [ -e "$bls_entry" ] || continue # Nothing matched: the glob stays literal
+    grep -q "iommu=pt" "$bls_entry" || sed -i "s/^\(options .*\)/\1 $IOMMU_ARGS/" "$bls_entry" # Patch the options line of each entry once
+done
+
+grep -q "nested=1" /mnt/sysimage/etc/modprobe.d/kvm.conf 2>/dev/null || echo "options kvm_amd nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization on AMD CPUs, exactly once
 
 %end # End of the %post section

cook/ingredients/hypervisor/intelcpu.ks

@@ -2,12 +2,27 @@
 
 %post --nochroot --log=/mnt/sysimage/root/hypervisor-intelcpu-post.log # Beginning of %post section. Those commands are executed outside the chroot environment. Logging is enabled to help with post-installation troubleshooting
 
-if [ -f /mnt/sysimage/etc/kernel/cmdline ]; then # systemd-boot: kernel arguments live in /etc/kernel/cmdline
+# Kernel arguments cannot be attached to a single canonical location at %post time:
-    grep -q "intel_iommu=on" /mnt/sysimage/etc/kernel/cmdline || sed -i 's/$/ intel_iommu=on iommu=pt rd.driver.pre=vfio-pci/' /mnt/sysimage/etc/kernel/cmdline # Append IOMMU arguments once
+# anaconda always creates /etc/kernel/cmdline (kernel-install source for both
-else # GRUB: kernel arguments live in /etc/default/grub
+# systemd-boot and GRUB+BLS layouts), but GRUB+BLS boot entries have already been
-    sed -i 's/\(quiet\)/\1 intel_iommu=on iommu=pt rd.driver.pre=vfio-pci/i' /mnt/sysimage/etc/default/grub # Load kernel modules in GRUB.
+# generated from it by the kernel package scriptlets, and non-BLS flows still read
+# /etc/default/grub. Update every surface idempotently, guarded by file existence.
+
+IOMMU_ARGS="intel_iommu=on iommu=pt rd.driver.pre=vfio-pci"
+
+if [ -f /mnt/sysimage/etc/kernel/cmdline ]; then # kernel-install source (systemd-boot now, GRUB+BLS for future kernels)
+    grep -q "intel_iommu=on" /mnt/sysimage/etc/kernel/cmdline || echo " $IOMMU_ARGS" >> /mnt/sysimage/etc/kernel/cmdline # Append IOMMU arguments once
 fi
 
-echo "options kvm_intel nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization on Intel CPUs
+if [ -f /mnt/sysimage/etc/default/grub ]; then # GRUB: arguments for grub.cfg-based boot flows
+    grep -q "intel_iommu=on" /mnt/sysimage/etc/default/grub || sed -i "s/\(quiet\)/\1 $IOMMU_ARGS/i" /mnt/sysimage/etc/default/grub # Append IOMMU arguments once
+fi
+
+for bls_entry in /mnt/sysimage/boot/loader/entries/*.conf; do # Already-generated boot entries share one "options" line shape
+    [ -e "$bls_entry" ] || continue # Nothing matched: the glob stays literal
+    grep -q "intel_iommu=on" "$bls_entry" || sed -i "s/^\(options .*\)/\1 $IOMMU_ARGS/" "$bls_entry" # Patch the options line of each entry once
+done
+
+grep -q "nested=1" /mnt/sysimage/etc/modprobe.d/kvm.conf 2>/dev/null || echo "options kvm_intel nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization on Intel CPUs, exactly once
 
 %end # End of the %post section

cook/ingredients/initial-setup/gnome/config.ks

@@ -10,16 +10,16 @@ gnome-initial-setup # Add GNOME initial setup too to let user create local accou
 
 %end # End of the packages section
 
-# %post --nochroot --log=/mnt/sysimage/root/initial-setup-gnome.log # Beginning of %post section. Those commands are executed outside the chroot environment. Add logging.
+%post --nochroot --log=/mnt/sysimage/root/initial-setup-gnome.log # Beginning of %post section. Those commands are executed outside the chroot environment. Add logging.
-# 
+
-# truncate -s 0 /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf # remove content of vendor.conf so that all options are made available
+truncate -s 0 /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf # remove content of vendor.conf so that all options are made available
-# 
+
-# ## Append lines to existing vendor.conf file, so that options are skipped upon reboot
+## Append lines to existing vendor.conf file, so that options are skipped upon reboot
-# cat >> /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf<< EOF
+cat >> /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf<< EOF
-# [pages]
+[pages]
-# skip=privacy
+skip=privacy
-# [goa]
+[goa]
-# providers=local-first!
+providers=local-first!
-# EOF
+EOF
-# 
+
-# %end # End of the %post section
+%end # End of the %post section

cook/ingredients/storage/biosboot.ks

@@ -0,0 +1,8 @@
+# BIOS boot storage configuration (GPT disk label with a BIOS boot partition)
+
+zerombr # Destroy all the contents of disks with invalid partition tables or other formatting unrecognizable to the installer
+clearpart --all --initlabel --disklabel=gpt # Erase all partitions, initialize a GPT disk label, and initialize the disk label to the default for the target architecture
+
+part biosboot --fstype="biosboot" --size=2 --label=biosboot # Creates a 2 MiB BIOS boot partition, required to install GRUB on a GPT-labelled disk under legacy BIOS firmware
+part /boot --fstype="ext4" --size=2048 --label=boot # Creates a 2048 MiB ext4 boot partition
+part / --fstype="ext4" --grow --label=root --mkfsoptions="-O encrypt,fast_commit" # Create a single root partition with the remaining space

cook/recipe_templates.yaml

@@ -35,6 +35,7 @@ choices:
   storage:
     standard: storage/standard.ks
     encrypted: storage/encrypted.ks
+    biosboot: storage/biosboot.ks
   bootloader:
     grub: bootloader/grub.ks
     systemd-boot: bootloader/systemd-boot.ks
@@ -60,6 +61,9 @@ features:
       - hypervisor/base/services.ks
       - hypervisor/base/post-scripts.ks
     desktop:
+      - hypervisor/base/packages.ks
+      - hypervisor/base/services.ks
+      - hypervisor/base/post-scripts.ks
       - packages/virtual-machine-manager/packages.ks
       - packages/virtual-machine-manager/post-scripts.ks
   hypervisor_type:

cook/recipes_manifest.yaml

@@ -46,15 +46,16 @@ recipes:
         guest-agents: false
         hypervisor: base
         hypervisor_type: intelcpu
-#
+  # Desktop-hypervisor variants
-#  # Desktop-hypervisor variants
+  - name: desktop-hypervisor
-#  - name: desktop-hypervisor
+    variants:
-#    variants:
+      - repository: "44"
-#      - repository: 43
+        desktop: gnome
-#        desktop: gnome
+        storage: biosboot
-#        storage: standard
+        bootloader: grub
-#        bootloader: grub
+        security: enabled
-#        hardware-support: false
+        initial-setup: gnome
-#        guest-agents: true
+        hardware-support: true
-#        hypervisor: desktop
+        guest-agents: false
-#        hypervisor_type: ["amdcpu", "intelcpu"]
+        hypervisor: desktop
+        hypervisor_type: intelcpu

cook/tests/test_generator.py

@@ -20,7 +20,7 @@ BASE_FRAGMENTS = [
     "core/locale.ks",
     "core/network.ks",
     "core/services.ks",
-    "packages/core.ks",
+    "packages/core-explicit.ks",
     "packages/fedora-remix.ks",
     "packages/hand-picked.ks",
 ]