The recently published Meltdown/Spectre hardware security flaws exploit speculative execution and the memory cache to gain information about the content of memory locations that the executing code is not permitted to access. If I understand the attacks correctly, a crucial final stage of the attack is to determine whether the content of a particular memory location is in the cache. But how can that be done?
I'm an application programmer who uses high level languages, so I'm used to measuring the average cache performance of code, through sampling (profiling), not the cache performance of a single instruction or memory location. How is it even possible to measure performance at such fine granularity?