# Intel CPU optimization for hypervisor

%post --nochroot --log=/mnt/sysimage/root/hypervisor-intelcpu-post.log # Beginning of %post section. Those commands are executed outside the chroot environment. Logging is enabled to help with post-installation troubleshooting

# Kernel arguments cannot be attached to a single canonical location at %post time:
# anaconda always creates /etc/kernel/cmdline (kernel-install source for both
# systemd-boot and GRUB+BLS layouts), but GRUB+BLS boot entries have already been
# generated from it by the kernel package scriptlets, and non-BLS flows still read
# /etc/default/grub. Update every surface idempotently, guarded by file existence.

IOMMU_ARGS="intel_iommu=on iommu=pt rd.driver.pre=vfio-pci"

if [ -f /mnt/sysimage/etc/kernel/cmdline ]; then # kernel-install source (systemd-boot now, GRUB+BLS for future kernels)
    grep -q "intel_iommu=on" /mnt/sysimage/etc/kernel/cmdline || echo " $IOMMU_ARGS" >> /mnt/sysimage/etc/kernel/cmdline # Append IOMMU arguments once
fi

if [ -f /mnt/sysimage/etc/default/grub ]; then # GRUB: arguments for grub.cfg-based boot flows
    grep -q "intel_iommu=on" /mnt/sysimage/etc/default/grub || sed -i "s/\(quiet\)/\1 $IOMMU_ARGS/i" /mnt/sysimage/etc/default/grub # Append IOMMU arguments once
fi

for bls_entry in /mnt/sysimage/boot/loader/entries/*.conf; do # Already-generated boot entries share one "options" line shape
    [ -e "$bls_entry" ] || continue # Nothing matched: the glob stays literal
    grep -q "intel_iommu=on" "$bls_entry" || sed -i "s/^\(options .*\)/\1 $IOMMU_ARGS/" "$bls_entry" # Patch the options line of each entry once
done

grep -q "nested=1" /mnt/sysimage/etc/modprobe.d/kvm.conf 2>/dev/null || echo "options kvm_intel nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization on Intel CPUs, exactly once

%end # End of the %post section