There's Open Source SMM as well (e.g. https://review.coreboot.org/plugins/gitiles/coreboot/+/HEAD/src/cpu/x86/smm/smm_module_handler.c https://review.coreboot.o

There's Open Source SMM as well (e.g. https://review.coreboot.org/plugins/gitiles/coreboot/+/HEAD/src/cpu/x86/smm/smm_module_handler.c https://review.coreboot.org/plugins/gitiles/coreboot/+/HEAD/...) and it's still a pain. "There's services outside the kernel's control that may or may not do what the kernel/userland/user expect because they can be independently updated, and, oh by the way, they're really powerful" is simply a pain to deal with.