From 8531fbf99dea1b4cd806babd6072a8a1f0506eb3 Mon Sep 17 00:00:00 2001
From: Raja Grewal <rg_public@proton.me>
Date: Tue, 19 Jul 2022 02:30:49 +1000
Subject: [PATCH] CPU mitigation - SRBDS

---
 etc/default/grub.d/40_cpu_mitigations.cfg | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/etc/default/grub.d/40_cpu_mitigations.cfg b/etc/default/grub.d/40_cpu_mitigations.cfg
index 1977eeb..fa9bd80 100644
--- a/etc/default/grub.d/40_cpu_mitigations.cfg
+++ b/etc/default/grub.d/40_cpu_mitigations.cfg
@@ -41,3 +41,8 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX tsx=off tsx_async_abort=full,nosmt"
 ##
 ## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/multihit.html
 GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX kvm.nx_huge_pages=force"
+
+## Enables mitigations for SRBDS to prevent MDS attacks on RDRAND and RDSEED instructions.
+##
+## https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/special-register-buffer-data-sampling.html
+GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX srbds=on"