BEGIN:VCALENDAR
VERSION:2.0
PRODID:Linklings LLC
BEGIN:VTIMEZONE
TZID:America/Los_Angeles
X-LIC-LOCATION:America/Los_Angeles
BEGIN:DAYLIGHT
TZOFFSETFROM:-0800
TZOFFSETTO:-0700
TZNAME:PDT
DTSTART:19700308T020000
RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=2SU
END:DAYLIGHT
BEGIN:STANDARD
TZOFFSETFROM:-0700
TZOFFSETTO:-0800
TZNAME:PST
DTSTART:19701101T020000
RRULE:FREQ=YEARLY;BYMONTH=11;BYDAY=1SU
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
DTSTAMP:20260730T152640Z
LOCATION:
DTSTART;TZID=America/Los_Angeles:20260728T175000
DTEND;TZID=America/Los_Angeles:20260728T175000
UID:dac_DAC 2026_sess317_RESEARCH1495@linklings.com
SUMMARY:PMU-Faker: The Apparently Harmless Performance Monitoring Unit Eve
 nts are Actually Harmful
DESCRIPTION:Zeru Lan (Key Laboratory of System Software (Chinese Academy o
 f Sciences) and State Key Laboratory of Computer Science, Institute of Sof
 tware, Chinese Academy of Sciences); Pengfei Qiu (Key Laboratory of System
  Software (Chinese Academy of Sciences) and State Key Laboratory of Comput
 er Science, Institute of Software, Chinese Academy of Sciences.); Yaxuan Z
 hao and Ziyan Huang (Key Laboratory of System Software (Chinese Academy of
  Sciences) and State Key Laboratory of Computer Science, Institute of Soft
 ware, Chinese Academy of Sciences); Zhihao Zhang (Key Laboratory of System
  Software (Chinese Academy of Sciences) and State Key Laboratory of Comput
 er Science, Institute of Software, Chinese Academy of Sciences.); Jiayi Gu
 o and Chunlu Wang (Key Laboratory of System Software (Chinese Academy of S
 ciences) and State Key Laboratory of Computer Science, Institute of Softwa
 re, Chinese Academy of Sciences); Dongsheng Wang (Tsinghua University & Zh
 ongguancun Laboratory); and Gang Qu (University of Maryland)\n\nPrevious s
 tudies have verified that some special Performance Monitoring Unit (PMU) e
 vents are insecure. In this work, we further disclose that even the PMU ev
 ents are securely designed and implemented, they are capable of constructi
 ng malicious attacks.\nWe develop and implement a fuzz testing framework t
 o automatically identify and verify numerous PMU events. Based on which, w
 e successfully discover 118 vulnerable PMU events. Leveraging these identi
 fied events, we introduce PMU-Faker, a precise timing mechanism that can i
 mplement most of the timing-based side channel attacks without timer. To a
 ccommodate variations in instruction-triggered cycle durations, PMU-Faker 
 provides two timing mechanisms with varying levels of granularity, thereby
  balancing precision and adaptability. Moreover, we successfully utilizing
  PMU-Faker to implement four attacks including executing transient executi
 on attacks, extracting AES's key, conducting attacks against Intel Softwar
 e Guard Extensions (SGX), and achieving cross-virtual machine information 
 leakage.\n\nTrack: EDA7-II. Physical Design and Verification, Design\n\nSe
 ssion Chairs: Christian Pilato (Politecnico di Milano); Mohsen Imani (Univ
 ersity of California, Irvine); Flavio Ponzina (San Diego State University)
 ; Amin Farshidi (Cadence Design Systems, Inc.); Yonggan Fu (Georgia Instit
 ute of Technology, NVIDIA); Dimitrios Tsaras (Huawei, Hong Kong University
  of Science and Technology (HKUST)); Anh Nguyen (Fujitsu Limited); Ruiyang
  Qin (Villanova University); Jiliang Zhang (Hunan University); Meng Li (Pe
 king University); and Rassul Bairamkulov (Advanced Micro Devices (AMD))\n\
 n
END:VEVENT
END:VCALENDAR