SGX is very useful. Source: I built a product that made it easier to use and we explored a lot of use cases as part of that. Firstly yes SGX is designed to blo

SGX is very useful. Source: I built a product that made it easier to use and we explored a lot of use cases as part of that. Firstly yes SGX is designed to block firmware attacks. That's a part of the threat model indeed. Secondly, you can't feed data from SGX enclaves directly to hardware devices. It's encrypted data in, encrypted data out. Of course, data must pass through the untrusted host OS and hypervisor, but that is no problem, it's how it's designed to work. That's why the clients of the enclave handshake with it using remote attestation. You can block side channel attacks with SGX if you are careful. The enclave transitions do clear uarch state in the ways needed, the rest is app-level stuff (but it has to be). I used to see a lot of confusion about stuff like SGX because some people don't realize it's only intended to be used with remote attestation. If you don't have a smart client that's remotely attesting the enclave over a network, it isn't going to get you anything. That requires changes to app architectures.