Controlling access to the memory cache

And probably the TLBs too - I don't see why the cache attacks couldn't be adapted to run on them (albeit with 4KB resolution rather than 64B, and I think TLBs aren't shared between cores so it could only spy on other threads if they were running on the same core with hyperthreading).

Incidentally, rather than relying on JS, I wonder if you could do these L3 cache attacks using WebGL, given that Intel GPUs share the CPU's L3/LLC? I think it might be relatively straightforward if they supported GLES 3.1 functionality - write a compute shader that runs N threads each looping over 1/N of a cache-sized buffer (with large N to maximise bandwidth utilisation and improve the attack's temporal resolution), and measure the latency of each access by reading a global counter that's atomically incremented in a tight loop by another thread. Not sure if it's possible to do something equivalent with GLES 2.0/3.0 features though, since I can't see how to measure latency in them.