You arrange things so that the speculated execution loads from an address you provide (this is the target address you want to read), then uses the result of tha

You arrange things so that the speculated execution loads from an address you provide (this is the target address you want to read), then uses the result of that load to calculate the address of another load (this one, into a location that aliases in the cache with an address you can load directly yourself). You can then use cache timing to see which address was read in the second load, which means you can see part of the value that was read in the first load. Rinse, repeat. The variants mostly amount to differences in how you arrange the first part (speculated execution loading from an address you get to provide).