Skimming the flush+reload paper I see how timing alone is enough to get e.g. a private key if the underlying algorithms are known and prone to revealing what th

Skimming the flush+reload paper I see how timing alone is enough to get e.g. a private key if the underlying algorithms are known and prone to revealing what they're working on. Meltdown however seems to be able to arbitrarily read memory (at about ~500 kB/s). How does this work that it can read from the cache?