[MODERATED] Re: [patch V4 11/11] Documentation: Add MDS vulnerability documentation

On 2/22/19 2:24 PM, speck for Thomas Gleixner wrote:
> +Contrary to other speculation based vulnerabilities the MDS vulnerability
> +does not allow the attacker to control the memory target address. As a
> +consequence the attacks are purely sampling based, but as demonstrated with
> +the TLBleed attack samples can be postprocessed successfully.

I saw this "sampling-based" terminology in Andi's docs too.  Personally,
I find it a bit confusing.  I think it's trying to make a distinction
between attacks that pull data out of memory and attacks that pull data
out of CPU-internal state that came from somewhere else.  Maybe
something like:

	Other attacks such as Spectre and Meltdown tend to target data
	at a specific memory address.  The MDS vulnerability itself can
	not be targeted at memory and can only leak memory contents that
	have been loaded into the CPU buffers by other means.

Or, is it trying to make a *timing* argument?