feat(cdi): real AMD ROCm + Intel iGPU CDI generation in mios-cdi-detect

Replaces the stub branches with working implementations grounded in
upstream tooling (May 2026 state per project research pass):

mios-cdi-detect changes:
* AMD branch  -- runs `amd-ctk cdi generate --output=/run/cdi/amd.json`
                  when /dev/kfd exists and amd-ctk is on PATH. Validates
                  the generated spec via `amd-ctk cdi validate` and
                  moves invalid output aside as amd.json.invalid so
                  podman doesn't pick up a broken file.
* Intel branch -- iterates /dev/dri/renderD* nodes, matches
                  vendor:0x8086 to detect Intel iGPU/Arc, then runs
                  /usr/libexec/mios/intel-cdi-specs-generator to emit
                  /run/cdi/intel.yaml. Marked best-effort -- upstream
                  tooling is v0.x.
* NVIDIA branch -- expanded WSL2 detection: in addition to
                  systemd-detect-virt=wsl, also picks the WSL mode
                  when /dev/dxg exists (covers podman-machine WSL2
                  distros where systemd-detect-virt may not return
                  wsl from the nested ns). Emits nvidia-wsl.yaml in
                  WSL mode, nvidia.yaml in auto/native mode.
* Status      -- now writes both /run/mios/cdi-detect.status (env-style
                  legacy) AND /run/mios/gpu-passthrough.status (JSON
                  for boot-diag / dashboard consumers).

automation/41-gpu-cdi-toolkits.sh (new):
* Fetches AMD Container Toolkit v1.3+ as the RHEL9 RPM from
  github.com/ROCm/container-toolkit releases. RHEL9 RPM is
  glibc/systemd-ABI-compatible with Fedora 44. Tries dnf5 / dnf /
  rpm in order so the install works on minimal images that haven't
  pulled libdnf5 yet.
* Fetches the Intel CDI specs-generator from intel/intel-resource-
  drivers-for-kubernetes releases (canonical asset name first, fall
  back to release-JSON glob match for asset-name drift).
* Both follow the project policy: api.github.com lookup with
  pinned _FALLBACK_TAG when rate-limited or offline. Failed fetches
  warn but do not break the build -- mios-cdi-detect's branches
  no-op cleanly when the binary is missing.

PACKAGES.md updates:
* Uncomments intel-level-zero (ships in F44 via intel-compute-runtime
  source RPM as of the IntelCompute2025 packaging change).
* Renames intel-gpu-tools -> igt-gpu-tools (Fedora 44 rename).
  Retracts the "needs libproc2.so.0" comment -- F44 carries that lib.
* Adds a new "GPU Container Device Interface toolkits" section that
  documents amd-ctk + intel-cdi-specs-generator as fetched by
  41-gpu-cdi-toolkits.sh (parallel to nvidia-container-toolkit which
  ships via dnf in the gpu-nvidia block).

Sources:
* https://github.com/ROCm/container-toolkit
* https://instinct.docs.amd.com/projects/container-toolkit/en/latest/container-runtime/cdi-guide.html
* https://github.com/intel/intel-resource-drivers-for-kubernetes/releases
* https://github.com/cncf-tags/container-device-interface

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Kabuki94

automation/41-gpu-cdi-toolkits.sh

@@ -0,0 +1,114 @@
+#!/bin/bash
+# 41-gpu-cdi-toolkits: install vendor CDI generators (AMD + Intel)
+#
+# NVIDIA's nvidia-ctk ships via the nvidia-container-toolkit RPM
+# (handled in 35-* GPU passes / repo enablement). AMD and Intel each
+# distribute their CDI tooling outside Fedora's main repos as of
+# May 2026, so we fetch them here:
+#
+#   AMD: amd-ctk           -- AMD Container Toolkit v1.3+ RHEL9 RPM
+#                              (Fedora 44 is glibc/systemd-compatible)
+#                              upstream: github.com/ROCm/container-toolkit
+#                              docs:     instinct.docs.amd.com
+#                                        /projects/container-toolkit/
+#                                        /en/latest/container-runtime/cdi-guide.html
+#
+#   Intel: intel-cdi-specs-generator
+#                          -- intel/intel-resource-drivers-for-kubernetes
+#                              v0.1+ static binary; non-Kubernetes path
+#                              for podman/docker hosts. Tooling is v0.x
+#                              and trails NVIDIA/AMD in polish; install
+#                              best-effort under /usr/libexec/mios so
+#                              mios-cdi-detect can use it when present.
+#
+# Both lookups follow the project policy: hit api.github.com for the
+# latest tag, fall back to a pinned _FALLBACK_TAG when rate-limited
+# or offline. Skip the install (warn, don't fail) when neither path
+# yields a binary -- mios-cdi-detect's branches no-op cleanly if the
+# tool is missing.
+set -euo pipefail
+# shellcheck source=lib/common.sh
+source "$(dirname "$0")/lib/common.sh"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPT_DIR}/lib/packages.sh"
+
+# Pinned fallbacks (bump as upstream releases). Keep these matched
+# to the most recent verified-on-MiOS-build version so a network blip
+# doesn't ship a mystery binary.
+AMD_CTK_FALLBACK_TAG="v1.3.0"
+INTEL_SG_FALLBACK_TAG="v0.7.0"
+
+# ── AMD Container Toolkit (amd-ctk) ──────────────────────────────────
+echo "[41-gpu-cdi] AMD: resolving latest amd-container-toolkit release..."
+AMD_TAG=$( (scurl -s https://api.github.com/repos/ROCm/container-toolkit/releases/latest \
+              | grep -Po '"tag_name": "\K.*?(?=")') 2>/dev/null || true)
+if [[ -z "$AMD_TAG" ]]; then
+    warn "AMD container toolkit: api.github.com lookup empty -- using fallback ${AMD_CTK_FALLBACK_TAG}"
+    AMD_TAG="$AMD_CTK_FALLBACK_TAG"
+fi
+record_version amd-container-toolkit "$AMD_TAG" "https://github.com/ROCm/container-toolkit/releases/tag/${AMD_TAG}"
+
+# AMD ships .rpm (RHEL/CentOS 9) + .deb (Ubuntu) only -- no Fedora
+# package as of May 2026. RHEL9 RPM works on Fedora 44 (same glibc /
+# systemd ABI). Asset name pattern observed on releases:
+#   amd-container-toolkit-<ver>-1.el9.x86_64.rpm
+AMD_VER="${AMD_TAG#v}"
+AMD_RPM="amd-container-toolkit-${AMD_VER}-1.el9.x86_64.rpm"
+AMD_URL="https://github.com/ROCm/container-toolkit/releases/download/${AMD_TAG}/${AMD_RPM}"
+
+mkdir -p /tmp/amd-cdi-dl
+if scurl -sfL "$AMD_URL" -o "/tmp/amd-cdi-dl/${AMD_RPM}" 2>/dev/null; then
+    if dnf5 install -y "/tmp/amd-cdi-dl/${AMD_RPM}" >/dev/null 2>&1 \
+       || dnf  install -y "/tmp/amd-cdi-dl/${AMD_RPM}" >/dev/null 2>&1 \
+       || rpm  -ivh --replacepkgs "/tmp/amd-cdi-dl/${AMD_RPM}" >/dev/null 2>&1; then
+        echo "[41-gpu-cdi]   [ok] AMD container toolkit ${AMD_TAG} installed"
+    else
+        warn "AMD RPM downloaded but install failed -- skipping (non-fatal)"
+    fi
+else
+    warn "AMD container toolkit: ${AMD_URL} not reachable -- skipping (non-fatal)"
+fi
+rm -rf /tmp/amd-cdi-dl
+
+# ── Intel CDI specs generator ────────────────────────────────────────
+echo "[41-gpu-cdi] Intel: resolving latest intel-resource-drivers-for-kubernetes release..."
+INTEL_TAG=$( (scurl -s https://api.github.com/repos/intel/intel-resource-drivers-for-kubernetes/releases/latest \
+                | grep -Po '"tag_name": "\K.*?(?=")') 2>/dev/null || true)
+if [[ -z "$INTEL_TAG" ]]; then
+    warn "Intel CDI generator: api.github.com lookup empty -- using fallback ${INTEL_SG_FALLBACK_TAG}"
+    INTEL_TAG="$INTEL_SG_FALLBACK_TAG"
+fi
+record_version intel-cdi-specs-generator "$INTEL_TAG" \
+    "https://github.com/intel/intel-resource-drivers-for-kubernetes/releases/tag/${INTEL_TAG}"
+
+# Asset shape varies across the project's releases. Try the canonical
+# shape first; fall back to a glob-match against the release index.
+INTEL_BIN="intel-cdi-specs-generator-linux-amd64"
+INTEL_URL="https://github.com/intel/intel-resource-drivers-for-kubernetes/releases/download/${INTEL_TAG}/${INTEL_BIN}"
+
+mkdir -p /tmp/intel-cdi-dl
+if scurl -sfL "$INTEL_URL" -o "/tmp/intel-cdi-dl/${INTEL_BIN}" 2>/dev/null \
+   && [[ -s "/tmp/intel-cdi-dl/${INTEL_BIN}" ]]; then
+    install -d -m 0755 /usr/libexec/mios
+    install -m 0755 "/tmp/intel-cdi-dl/${INTEL_BIN}" /usr/libexec/mios/intel-cdi-specs-generator
+    echo "[41-gpu-cdi]   [ok] Intel CDI specs-generator ${INTEL_TAG} installed at /usr/libexec/mios/intel-cdi-specs-generator"
+else
+    # Fallback: query the release JSON for any *specs-generator* asset.
+    # Best-effort -- tooling is v0.x and asset naming has shifted.
+    asset_url=$( (scurl -s "https://api.github.com/repos/intel/intel-resource-drivers-for-kubernetes/releases/tags/${INTEL_TAG}" \
+                    | grep -oP '"browser_download_url": "\K[^"]*' \
+                    | grep -E 'specs-generator.*linux' \
+                    | grep -E 'amd64|x86_64' \
+                    | head -1) 2>/dev/null || true)
+    if [[ -n "$asset_url" ]] && scurl -sfL "$asset_url" -o /tmp/intel-cdi-dl/sg.bin 2>/dev/null \
+       && [[ -s /tmp/intel-cdi-dl/sg.bin ]]; then
+        install -d -m 0755 /usr/libexec/mios
+        install -m 0755 /tmp/intel-cdi-dl/sg.bin /usr/libexec/mios/intel-cdi-specs-generator
+        echo "[41-gpu-cdi]   [ok] Intel CDI specs-generator ${INTEL_TAG} installed (fallback asset path)"
+    else
+        warn "Intel CDI specs-generator: no asset matched on ${INTEL_TAG} -- skipping (non-fatal)"
+    fi
+fi
+rm -rf /tmp/intel-cdi-dl
+
+echo "[41-gpu-cdi] done."

usr/libexec/mios/mios-cdi-detect

@@ -1,59 +1,134 @@
 #!/usr/bin/env bash
-# 'MiOS' CDI spec detection -- generate Container Device Interface specs
-# for every detected GPU vendor before nvidia-cdi-refresh.service fires.
-# Run by mios-cdi-detect.service (Before=nvidia-cdi-refresh.service).
+# 'MiOS' CDI spec detection -- generate Container Device Interface
+# specs for every detected GPU vendor before nvidia-cdi-refresh.service
+# fires. Run by mios-cdi-detect.service (Before=nvidia-cdi-refresh.service).
 #
 # Writes specs to /run/cdi/ (declared in usr/lib/tmpfiles.d/mios-gpu.conf
-# under LAW 2). On WSL2 we generate with --mode=wsl. On bare metal /
-# regular VMs the mode is auto-detected. AMD ROCm and Intel iGPU specs
-# are stubs (upstream tooling is still emerging) -- only NVIDIA gets a
-# real CDI spec today.
+# under LAW 2). All paths are best-effort -- a missing toolkit makes
+# the corresponding branch a no-op rather than failing the boot.
 #
-# When no GPU is present (e.g. headless server, container, WSL2 without
-# /dev/dxg), this is a no-op (writes an empty status file).
-set -euo pipefail
+# Vendor coverage (May 2026):
+#   * NVIDIA  via nvidia-ctk (NVIDIA Container Toolkit v1.19+)
+#             /run/cdi/nvidia.yaml or /run/cdi/nvidia-wsl.yaml
+#   * AMD     via amd-ctk    (AMD Container Toolkit v1.3+, Apr 2026)
+#             /run/cdi/amd.json -- AMD outputs JSON, not YAML
+#   * Intel   via intel-cdi-specs-generator
+#             (intel/intel-resource-drivers-for-kubernetes v0.1+)
+#             /run/cdi/intel.yaml -- best-effort; tooling is v0.x
+#
+# When no GPU is present (headless server, container without /dev/dxg
+# or /dev/kfd or /dev/dri), this is a no-op except for the status
+# snapshot at /run/mios/cdi-detect.status.
+set -uo pipefail
 # shellcheck source=/usr/lib/mios/paths.sh
-source /usr/lib/mios/paths.sh
+source /usr/lib/mios/paths.sh 2>/dev/null || true
 
-_log()  { logger -t mios-cdi-detect "$*" 2>/dev/null || true; echo "[cdi-detect] $*" >&2; }
+_log() { logger -t mios-cdi-detect "$*" 2>/dev/null || true; echo "[cdi-detect] $*" >&2; }
 
 install -d -m 0755 /run/cdi /run/mios
+
 VIRT=$(systemd-detect-virt 2>/dev/null || echo none)
 HAS_NVIDIA=0
 HAS_AMD=0
 HAS_INTEL=0
-[[ -e /dev/nvidia0 || -e /dev/dxg ]]              && HAS_NVIDIA=1
-[[ -e /dev/kfd ]]                                  && HAS_AMD=1
-[[ -e /dev/dri/renderD128 ]]                       && HAS_INTEL=1
+[[ -e /dev/nvidia0 || -e /dev/dxg ]] && HAS_NVIDIA=1
+[[ -e /dev/kfd ]]                    && HAS_AMD=1
+# Intel iGPU/Arc detection: a renderD* node whose vendor reads 0x8086.
+# Iterate every renderD* node so multi-GPU boxes are correctly handled
+# (e.g. discrete NVIDIA + Intel iGPU coexisting).
+for r in /dev/dri/renderD*; do
+    [[ -e "$r" ]] || continue
+    pci=$(readlink -f "/sys/class/drm/$(basename "$r")/device" 2>/dev/null)
+    [[ -n "$pci" && -r "$pci/vendor" ]] || continue
+    if [[ "$(cat "$pci/vendor" 2>/dev/null)" == "0x8086" ]]; then
+        HAS_INTEL=1
+        break
+    fi
+done
 
 _log "virt=$VIRT nvidia=$HAS_NVIDIA amd=$HAS_AMD intel=$HAS_INTEL"
 
-# NVIDIA: prefer upstream nvidia-cdi-refresh.service when its unit is
-# installed (toolkit v1.18+). Otherwise generate the spec ourselves.
+# ── NVIDIA ───────────────────────────────────────────────────────────
+# Prefer upstream nvidia-cdi-refresh.service when its unit is installed
+# (NVIDIA Container Toolkit v1.18+). It auto-regenerates on driver/device
+# change, so we don't want to race with it.
 if [[ "$HAS_NVIDIA" == 1 ]] && command -v nvidia-ctk >/dev/null 2>&1; then
-    if systemctl list-unit-files nvidia-cdi-refresh.service 2>/dev/null \
-         | grep -q nvidia-cdi-refresh; then
-        _log "nvidia-cdi-refresh.service present; deferring spec generation"
+    if systemctl list-unit-files nvidia-cdi-refresh.service 2>/dev/null | grep -q nvidia-cdi-refresh; then
+        _log "nvidia: nvidia-cdi-refresh.service present -- deferring to upstream"
     else
+        # WSL2 surfaces GPUs via /dev/dxg with the standard WDDM
+        # paravirt driver. nvidia-ctk's --mode=wsl emits a CDI spec
+        # that picks up the host's NVIDIA driver via the WSL /usr/lib/
+        # wsl/lib bind-mount.
         mode_arg=()
-        [[ "$VIRT" == "wsl" ]] && mode_arg=(--mode=wsl)
-        if nvidia-ctk cdi generate "${mode_arg[@]}" \
-                --output=/run/cdi/nvidia.yaml 2>/dev/null; then
-            _log "wrote /run/cdi/nvidia.yaml"
+        out=/run/cdi/nvidia.yaml
+        if [[ "$VIRT" == "wsl" || -e /dev/dxg ]]; then
+            mode_arg=(--mode=wsl)
+            out=/run/cdi/nvidia-wsl.yaml
+        else
+            # nvidia-ctk auto-detects mode (nvml/csv/management) on
+            # bare metal; --mode=auto is the explicit form.
+            mode_arg=(--mode=auto)
+        fi
+        if nvidia-ctk cdi generate "${mode_arg[@]}" --output="$out" 2>&1 | logger -t mios-cdi-detect; then
+            _log "nvidia: wrote $out (mode=${mode_arg[0]#--mode=})"
         else
-            _log "nvidia-ctk cdi generate failed (non-fatal)"
+            _log "nvidia: nvidia-ctk cdi generate failed (non-fatal)"
         fi
     fi
+elif [[ "$HAS_NVIDIA" == 1 ]]; then
+    _log "nvidia: device present but nvidia-ctk missing -- install nvidia-container-toolkit"
 fi
 
-# AMD: drop a placeholder if amd-ctk ever appears
+# ── AMD (ROCm) ───────────────────────────────────────────────────────
+# AMD Container Toolkit v1.3.0 (Apr 2026) ships amd-ctk which
+# generates a CDI spec the same way nvidia-ctk does. Output is JSON
+# by default; podman accepts both .yaml and .json under /etc/cdi or
+# /run/cdi. Spec naming follows the CNCF CDI convention:
+# vendor.com/class=identifier -> amd.com/gpu=all.
 if [[ "$HAS_AMD" == 1 ]] && command -v amd-ctk >/dev/null 2>&1; then
-    amd-ctk cdi generate --output=/run/cdi/amd.json 2>/dev/null \
-        && _log "wrote /run/cdi/amd.json" \
-        || _log "amd-ctk cdi generate failed (non-fatal)"
+    if amd-ctk cdi generate --output=/run/cdi/amd.json 2>&1 | logger -t mios-cdi-detect; then
+        _log "amd: wrote /run/cdi/amd.json"
+        # Validate the spec with the toolkit's own checker; mark the
+        # spec stale if it fails so podman doesn't pick up a broken file.
+        if amd-ctk cdi validate --path=/run/cdi/amd.json >/dev/null 2>&1; then
+            _log "amd: spec validated"
+        else
+            _log "amd: spec validation FAILED -- moving aside"
+            mv -f /run/cdi/amd.json /run/cdi/amd.json.invalid 2>/dev/null || true
+        fi
+    else
+        _log "amd: amd-ctk cdi generate failed (non-fatal)"
+    fi
+elif [[ "$HAS_AMD" == 1 ]]; then
+    _log "amd: /dev/kfd present but amd-ctk missing -- run automation/41-gpu-cdi-toolkits.sh"
 fi
 
-# Status snapshot
+# ── Intel (iGPU / Arc) ───────────────────────────────────────────────
+# Intel's CDI tooling lives in intel/intel-resource-drivers-for-kubernetes.
+# The specs-generator binary is a non-Kubernetes friendly way to
+# produce a /etc/cdi/intel.yaml. Best-effort: this binary is at v0.x
+# upstream and lacks the polish of nvidia-ctk / amd-ctk -- failures
+# here are logged but never break the boot.
+if [[ "$HAS_INTEL" == 1 ]]; then
+    INTEL_GEN=""
+    for cand in /usr/libexec/mios/intel-cdi-specs-generator \
+                /usr/local/bin/intel-cdi-specs-generator \
+                /usr/bin/intel-cdi-specs-generator; do
+        if [[ -x "$cand" ]]; then INTEL_GEN="$cand"; break; fi
+    done
+    if [[ -n "$INTEL_GEN" ]]; then
+        if "$INTEL_GEN" --output=/run/cdi/intel.yaml 2>&1 | logger -t mios-cdi-detect; then
+            _log "intel: wrote /run/cdi/intel.yaml via $INTEL_GEN"
+        else
+            _log "intel: specs-generator failed (non-fatal; tooling is v0.x best-effort)"
+        fi
+    else
+        _log "intel: GPU present but intel-cdi-specs-generator missing -- run automation/41-gpu-cdi-toolkits.sh"
+    fi
+fi
+
+# ── Status snapshot for the dashboard / mios-boot-diag ───────────────
 {
     echo "timestamp=$(date -Is)"
     echo "virt=$VIRT"
@@ -63,4 +138,17 @@ fi
     echo "cdi_specs=$(ls /run/cdi/ 2>/dev/null | tr '\n' ',' | sed 's/,$//')"
 } > /run/mios/cdi-detect.status
 
+# JSON variant for tooling that reads structured output (boot-diag's
+# `gpu-passthrough.status` consumer pattern).
+{
+    printf '{'
+    printf '"timestamp":"%s",'    "$(date -Is)"
+    printf '"virt":"%s",'          "$VIRT"
+    printf '"nvidia":%s,'          "$HAS_NVIDIA"
+    printf '"amd":%s,'             "$HAS_AMD"
+    printf '"intel":%s,'           "$HAS_INTEL"
+    printf '"cdi_specs":"%s"'      "$(ls /run/cdi/ 2>/dev/null | tr '\n' ',' | sed 's/,$//')"
+    printf '}\n'
+} > /run/mios/gpu-passthrough.status
+
 exit 0

usr/share/mios/PACKAGES.md

@@ -365,8 +365,15 @@ All packages are in official Fedora repos -- no extra repo needed.
 ```packages-gpu-intel-compute
 intel-compute-runtime
 intel-media-driver
-# level-zero REMOVED: not in F44 repos as standalone package.
-# intel-gpu-tools REMOVED: needs libproc2.so.0 missing in F44.
+# Intel oneAPI Level Zero loader. Ships in F44 via the
+# intel-compute-runtime source RPM under the name intel-level-zero
+# (the generic standalone "level-zero" loader is still in active
+# Fedora packaging review -- track Phoronix/Fedora-IntelCompute2025).
+intel-level-zero
+# IGT (Intel GPU Tools): renamed from intel-gpu-tools to igt-gpu-tools
+# in Fedora 44; provides intel_gpu_top, IGT test runner, and pmu-help
+# for diagnostics. The "needs libproc2.so.0" issue cleared on F44.
+igt-gpu-tools
 ```
 
 ## GPU Drivers -- NVIDIA (akmod, builds for any NVIDIA card)
@@ -388,6 +395,36 @@ xorg-x11-drv-nvidia-power
 nvidia-container-selinux
 ```
 
+## GPU Container Device Interface toolkits (vendor CDI generators)
+
+Out-of-Fedora binaries that emit `/run/cdi/*.{yaml,json}` so podman
+containers can claim GPU access via `--device <vendor>.com/gpu=all`.
+NVIDIA's `nvidia-ctk` is part of `nvidia-container-toolkit` (above);
+the AMD + Intel paths install via `automation/41-gpu-cdi-toolkits.sh`
+because neither ships in Fedora repos as of May 2026:
+
+* `amd-ctk` -- AMD Container Toolkit v1.3+ (RHEL9 RPM works on F44).
+  Source: github.com/ROCm/container-toolkit. Generates
+  `/run/cdi/amd.json` for any host with `/dev/kfd`. CDI key:
+  `amd.com/gpu=all`.
+
+* `intel-cdi-specs-generator` -- intel/intel-resource-drivers-for-
+  kubernetes static binary. Best-effort (v0.x upstream). Installed
+  to `/usr/libexec/mios/intel-cdi-specs-generator`. Generates
+  `/run/cdi/intel.yaml` for hosts with an Intel render node
+  (vendor:0x8086 on /dev/dri/renderD*). CDI key: `intel.com/gpu=all`.
+
+Both are consumed by `/usr/libexec/mios/mios-cdi-detect` at boot
+(via `mios-cdi-detect.service`). Missing toolkits make the
+corresponding branch a no-op rather than failing the boot.
+
+```packages-gpu-cdi-toolkits
+# Intentionally empty -- amd-ctk + intel-cdi-specs-generator are
+# fetched by automation/41-gpu-cdi-toolkits.sh from upstream
+# GitHub releases (same pattern as 37-aichat.sh / 38-oh-my-posh.sh).
+# Versions tracked via record_version (build metadata).
+```
+
 ## Virtualization -- KVM / QEMU / Libvirt
 
 System-level KVM stack: hypervisor, libvirt daemon, firmware, CLI helpers.