yeah

Signed-off-by: unexplrd <unexplrd@linerds.us>

hosts/dunamis/hardware.nix

@@ -27,6 +27,27 @@
       ];
     };
   };
+  boot.kernelParams = [
+    "mitigations=auto"
+    "spectre_v2=on"
+    "spectre_bhi=on"
+    "spec_store_bypass_disable=on"
+    "tsx=off"
+    "kvm.nx_huge_pages=force"
+    "nosmt=force"
+    "l1d_flush=on"
+    "spec_rstack_overflow=safe-ret"
+    "gather_data_sampling=force"
+    "reg_file_data_sampling=on"
+    "module.sig_enforce=1"
+    "lockdown=confidentiality"
+    "intel_iommu=on"
+    "amd_iommu=force_isolation"
+    "efi=disable_early_pci_dma"
+    "iommu=force"
+    "iommu.passthrough=0"
+    "iommu.strict=1"
+  ];
 
   hardware.graphics = {
     enable = true;