There's no such thing as bare metal any more. https://en.wikipedia.org/wiki/System_Management_Mode - the CPU itself may at times spend some time doing "other things" such as changing the spin speed of the cooling fans, or interpreting the signals from the USB keyboard. The OS (running in ring 0) has no control over this - the CPU effectively just pauses for a little bit every now and again.
TrustZone. It is "one level deeper" just like any other hypervisor or monitor. As far as I know, it is quite common in Android phones for HSM and DRM purposes. Yay? =\
