Reverse-Engineering the Address Translation Caches [pdf]