A single 1-second instruction breaks SMM's all-cores lockstep on x86

Researcher Christopher Domas (xoreaxeaxeax) has shown that System Management Mode — the invisible, ultra-privileged execution layer baked into every x86 CPU — can be desynchronized with nothing more than one absurdly slow machine instruction. SMM’s security depends on a rendezvous: when one core enters SMM, every core must enter, so nothing else is executing while the handler runs. But the firmware only waits about one second (roughly 4 billion cycles) for stragglers before giving up and proceeding. Keep a core busy inside a single uninterruptible instruction for longer than that timeout, and it never joins the rendezvous — leaving one core running normal code while the rest are trapped in SMM.

The trick is finding an instruction that stalls for over a second without ever hitting an instruction boundary (any gap would let the pending SMI pull the core in). The proof-of-concept, tuned for a Zen 3 Ryzen 7 5800H, points a wide vector load (vmovdqu into xmm) at a pathologically slow MMIO address and lets other cores contend on the same bus to drag the read out past the timeout. The PoC arms per-core SMI performance counters, fires a storm of SMIs via port 0xb2, and then checks whether any core’s tally diverged — proof that it kept executing outside SMM while its peers serviced the interrupts.

The significance is that this converts a long-ignored bug class into a real software threat. There are 100+ known SMM TOCTOU CVEs where a handler checks a shared-memory value and then trusts it; they’ve been dismissed as needing physical access or a malicious DMA peripheral, precisely because the rendezvous guaranteed no core was outside SMM to tamper with memory mid-handler. SMI desynchronization removes that prerequisite, making the dormant vulnerabilities exploitable from software alone. Worse, there’s no clean fix: removing the timeout lets one stuck core hang the whole platform, while raising it wrecks performance on many-core systems. For now, the only ‘workaround’ is the tongue-in-cheek advice to not run any very long instructions.