  Performance Monitoring Unit (PMU) is a common hardware module in Intel CPUs.
It can be used to record various CPU behaviors therefore it is often used for
performance analysis and optimization. Of the 65536 event spaces, Intel has
officially published only 200 or so. In this paper, we design a hidden PMU
event collection method. And we found a large number of undocumented PMU events
in CPUs of Skylake, Kabylake, and Alderlake microarchitectures. We further
demonstrate the existence of these events by using them for transient execution
attack detection and build-side channel attacks. This also implies that these
hidden PMU events have huge exploitation potential and security threats.
