Do ARM chips have ME or PSP equivalents? It would be great to be able to buy a new machine and use something like coreboot without having to use hacks to disable ME.
Intel and AMD sell an entire System-on-a-Chip disguised as a CPU processor. Their CPU is much more than a CPU core: they contain an entire system in there.
If you want to make a comparison, it is more correct to compare the Snapdragon and the Exynos chips to the off-the-shelves CPUs that Intel and AMD sell.
Arm only sells technologies that enable other companies to create a final product, it doesn't impose those kind of "management systems" and binary blobs.
In 2013 AMD successfully fabricated a CPU with said ARM Cortex core embedded, thus that was the first year they actually offered their PSP. AMD had similar problems with their APU's for a number of years IIRC, whereby making a single chip with both CPU and GPU on it had poor yields with a high percentage of dead chips.
They could have used MIPS, PowerPC or any other CPU cores for PSP, they just decided to go with Arm.
The only reason why it might not be considered a ME or PSP replacement is that the user can control the signing keys.
This means some companies have hidden proprietary code in their bootloaders. For example the Samsung Exynos have a range of ARM chips, but to boot them you must use their bootloader, which may contain spyware, backdoors or surveillance systems. You can not see the source code for this bootloader and have no way of auditing what it actually does.
Rockchip is another company that makes ARM chips, and can be considered mostly free [1]. As with all hardware it's very hard to know what's going on inside, but all the code to boot into Linux (minus the optional GPU) on a Rockchip product is open source and can be audited/compiled by anyone.
ARM also have TrustZone [2] that allows you to run applications in a "secure" (or separate) space. It doesn't run on a separate chip, but runs on the ARM chip, separating memory and instructions from the operating system. (Don't quote me but...) I believe you don't actually have to use TrustZone. The instructions/documentation for it doesn't appear to be available to the public, however if you don't upload a blob for TrustZone, with Rockchip it simply won't use it and will run everything on the same level. (Note this is true for Rockchip, but again depending on who is manufacturing the ARM chip, they may force you to use TrustZone).
Unlike with Intel ME and AMD PSP, if you don't want to use their ME, you have no choice. If you remove the blob your system won't boot (or will restart after 30 minutes for some older models).
This means if ARM TrustZone is compromised you can remove it and continue on as normal. But if ME and PSP are compromised you are at the will of Intel and any agency it may have colluded with.
While we're on the subject of free and open source code, note that with (most) ARM chips, the GPU is closed source just like the Intel ME. Again, the difference is if you don't want to use the GPU, you can just not upload the blob, and use the CPU without the GPU. There are some movements being made to open the GPU [3], but it's still a long way off.
1. https://libreboot.org/docs/hardware/c201.html
2. http://www.openvirtualization.org/open-source-arm-trustzone....
It's very very different than the dozen or so instructions to setup TXT or SGX that sits off to the side of the main OS rather than running like a super hypervisor. If you're going to compare it to something, it's way more like SMM on x86.
Source: I've ported a kernel to EL3 (secure mode).
SoC power management, system bringup, and maintenance tasks are complicated enough these days to warrant a full small core tacked onto the side. These cores are necessary, and aren't going away. Complaining about them being there is just pissing into the wind. Complain about what they're used for and the closed source nature of their code.
> However, while Intel ME can't be turned off completely, it is still possible to modify its firmware up to a point where Intel ME is active only during the boot process, effectively disabling it during the normal operation, which is what me_cleaner tries to accomplish.
https://github.com/corna/me_cleaner
EDIT: Also, the ME is inside the PCH, so I'm not really sure why you're making a distinction there.
Because Intel makes it required, or is it technically required?
Just like the similar cores you see in pretty much every ARM SoC.
There's a vast difference between such a core being used solely for bringup/power management/housekeeping and it having a network connection to the outside and being used for "remote management" (and running with godawfully insecure parsing code, at that).
> Complain about what they're used for and the closed source nature of their code.
All of these cores will have the ability to have network connections because they'll bringup the whole SoC including the network MAC.
So the real question is: will the laptops let end users replace the TrustZone kernel?
It's possible to build out SoCs that require a closed-source blob that runs on one of the ARM cores, doing basically all the same jobs a PSP or ME does.
A complication is that ARM only designs the ISA, implementors can very much add their own management system to the SoC.