For reading memory wouldn't the idea be to test N bits of Kernel Int each in a loop: for each bit in IntX, try speculative execution of bit data get the bit and

For reading memory wouldn't the idea be to test N bits of Kernel Int each in a loop: for each bit in IntX, try speculative execution of bit data get the bit and compute something that switches on 1/0 but with different timings. if(bit==1){expensive execution}else{do nothing} record all timings and reconstruct the IntX bits one by one. I assume something of that sort will allow reading memory without access.