This is the very thorough blog write-up discussing three variants of side-channel attacks that can be leveraged against CPU data cache timing.
You can download it from the following link: https://packetstormsecurity.com/files/download/145643/googleprojectzero-sidechannel.pdf
Source: https://packetstormsecurity.com/files/145643/Reading-Privileged-Memory-With-A-Side-Channel.html