Google, Amazon and Microsoft all have fully custom cores in the pipeline. I think Ampere may also have an ISA license from AppliedMicro. Not sure about NXP and Broadcom.

No, no CPU has seperate FPUs for SSE & AVX - it’s compiled to the same set of uOps by microcode.

Recent x86 CPUs go as far as implementing x87 in the 128b FPU too.

No, no CPU has seperate FPUs for SSE & AVX - it’s compiled to the same set of uOps by microcode.

Recent x86 CPUs go as far as implementing x87 in the 128b FPU too.

Yes, you understood correctly.

This is also not a rare occurence, you can programmatically find locations in a binary where un-doing a cached write allows manipulating control flow - there are more examples in the paper.

You will likely find these locations (called gadgets) in just about every binary - not because all devs are stupid and set the default to the “exploitable” case, but because this is how compiler code generation pans out in the grand scheme of things.

This is incorrect, the “default value” is a poorly translated example from the german article - this exploit does NOT rely on resetting any SEV-specific memory or similar.

tldr: The Host can trigger cache invalidations (without write back) in SEV-protected guests. Certainly an interesting oversight, easily fixed in microcode.