A legit concern. Basically everything that connects directly to the cache controllers has to get CCA right. Coherent GPUs are the big, complicated one. Intel h

A legit concern. Basically everything that connects directly to the cache controllers has to get CCA right. Coherent GPUs are the big, complicated one. Intel had an SGX bug where the GPU could access the last 16 bytes of every 64 byte cache line. If you need the GPU enabled, you have no choice but to design your enclave to only use the first 48 bytes of each cache line. Fortunately if you don't need the GPU, whether or not the GPU is enabled (among other things) is measured and included in the attestation quote, so clients can simply choose to refuse to talk to servers with the GPU enabled...