I'm sure you're all already aware... But just in case: Reading privileged memory with a side-channel https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html -- glen