AFAICT, the MMU cache isn't exposed, it's just using the same cache hardware on-chip, and you can time how long it takes to access certain things to figure out what's currently mapped into the cache (there are orders of magnitude difference in speeds for main memory vs cache, so even if you have no idea what's *in* cache, you can figure out where it's from). Also, breaking ASLR tells you *where* to read, but it shouldn't be able to tell you what's there without additional exploits being available.