Performance Monitoring Unit (PMU) is a common hardware module in Intel CPUs. It can be used to record various CPU behaviors therefore it is often used for performance analysis and optimization. Of the 65536 event spaces, Intel has officially published only 200 or so. In this paper, we design a hidden PMU event collection method. And we found a large number of undocumented PMU events in CPUs of Skylake, Kabylake, and Alderlake microarchitectures. We further demonstrate the existence of these events by using them for transient execution attack detection and build-side channel attacks. This also implies that these hidden PMU events have huge exploitation potential and security threats.

翻译：性能监控单元（PMU）是英特尔CPU中常见的硬件模块，可用于记录各种CPU行为，因此常被用于性能分析与优化。在65536个事件空间中，英特尔仅正式发布了约200个。本文设计了一种隐藏PMU事件收集方法，并在Skylake、Kabylake和Alderlake微架构的CPU中发现了大量未记录的PMU事件。我们进一步通过将这些事件用于瞬态执行攻击检测和构建侧信道攻击，验证了这些事件的存在性。这也表明这些隐藏PMU事件具有巨大的利用潜力和安全威胁。