Slashdot Mirror

Every time I see people discussing AMT, they leave out the final piece of the puzzle: Intel's SGX ("Software Guard Extensions") instructions that are in Skylake and future CPUs. SGX lets a program set up "secure enclaves" in RAM that are encrypted in the CPU and cannot be accessed by other programs, including the OS itself. As the data is encrypted outside of the CPU, you cannot even use a cold-boot attack or a logic analyser to access the data the hard way.

The only people talking about these instructions seem to be the occasional crypto researcher musing about how this could be a nice feature for protecting private keys. I'm sure that's possible, but Intel clearly has another goal in mind.

1. Allow application developers to protect sensitive data from unauthorized access or modification by rogue software running at higher privilege levels.

[...]

5. Enable the development of trusted applications [...]

6. Enable software vendors to deliver trusted applications and updates [...]

[...]

8. Enable applications to define secure regions of code and data that maintain confidentiality even when an attacker has physical control of the platform and can conduct direct attacks on memory.

In case anybody has forgotten, "trusted applications" is a dog whistle for DRM, originally popularized by Microsoft when they announced "Palladium". Good luck investigating what AMT is doing when the RAM it uses is encrypted.

Of course, some people in this very thread are already apologizing for Intel and claiming AMT isn't a threat. They probably said the same thing about Windows 10, too, with claims that the spyware wasn't important because it could (with much hassle) be disabled. Well, good luck in future Windows versions when the spyware is an encrypted SGX enclave.

True we can't know everything it can or can't do without a full read on the capabilities from Intel but I trust that if it were capable of offline access by anyone as you claim it would be public knowledge and wouldn't have made it very far.

Part of AMT is remote management, including being able to boot a server that lost power, reboot a frozen machine, wake machines for nightly patching and so on. Obviously it can't reach a machine that doesn't have power, but from the moment you plug in a vPro machine it's live even when it's "off". Maybe it's not public knowledge but you only need to read the advertisement:

Find It. Fix It. Anywhere
Intel(R) Active Management Technology provides remote management over wired or wireless networks across devices. Access clients through a secure channel irrespective of power or OS state, address issues while user is online, patch, repair, and upgrade operating systems and applications, and inventory client-side software and hardware.

Of course it's only supposed to talk to your puppet master inside your enterprise and only when it's enabled. But if you had a secret knock backdoor to access AMT on any computer, even when it is allegedly disabled - and perhaps even on CPUs that don't advertise the feature since it's probably there in silicon - that would be the mother of all back doors.

People often comment that only a datacentre or intensive database operation needs this kind of speed, but virtualization another application where IOPS are important.

I recently put together a small ESXi server with a couple of Intel 750 Series PCIe SSD's for VM storage, rated at 460,000 random read, 290,000 random write (4k) IOPS. Even with multiple VM's running, the responsiveness is like nothing I've experienced before.

1. They own McAfee, a widely derised security company, but nonetheless having a large market share of the desktop market, and perhaps looking to expand. 2. They also own Wind River, who sell software and development services into the automotive market (among other markets). 3. They've been pushing their processors to the automotive market for some time now, and already have some reference customers.

By their own word, revenue was $55.9 billion, and net income was $11.7 billion, so it's 0.05% of their net income.

The problem is Intel's new SGX ("Software Guard Extensions"). They allow the creation of memory regions that "maintain confidentiality even when an attacker has physical control of the platform and can conduct direct attacks on memory". The CPU encrypts RAM so you cannot pull keys out of it with a cold boot attack or a logic analyser on the memory bus.

Of course, the rare news article about SGX likes to assume this is something intended for the user so they can protect their GPG keys. What nobody is talking about is that this lets, for example, Microsoft create unbreakable DRM. MS will finally have their infamous Palladium "trusted computing" platform. They have already started the chain-of-trust with UEFI's SecureBoot. I hope people are taking the hint now with the Windows 10 scandal and fleeing the platform, because you aren't going to be able to remove their spyware once it is in the "trusted" enclave.

If that isn't worrying enough, consider what hidden SGX enclaves means for Intel's System Management Mode - the network enabled BIOS feature that allows remote access - which is already in your computer if have an Intel system newer than ~2010. This even works independent of the installed OS, so you can't get away from SMM by using Linux.

Ever get the feeling you don't actually own your computer? Current "trusted computing" design allows an untrusted OS to run most of the time by implementing the DRM/spyware at a lower hardware protection ring while making sure plaintext never leaves the CPU.

That may be because a server doesn't need a shit ton of CPU, and hardware AES helps.
The other aspect is your server Atom CPU has quite unrestricted power use, comparatively.
See, this quad core Atom (named Celeron) has a GPU, is constrained to about a third the power use and thus has to underclock itself.
http://ark.intel.com/fr/produc...

Constraining any CPU to well below 10 watts will make it suck (unless you're satisfied with the CPU power. Netbooks are quite good if they do what you want of them)

Sure looks like it

From the errata:

Executing CPUID with EAX = 7 and ECX = 0 may return EBX with bits [3] and [8] set, incorrectly indicating the presence of BMI1 and BMI2 instruction set extensions.

Attempting to use instructions from the BMI1 or BMI2 instruction set extensions will result in a #UD exception.

and in the errata summary, its currently labeled NO FIX so they dont even have a fix that will trap the exception and emulate the instructions (which would perform terribly anyways... but hey, working is better than not working.)

On the plus side, the script kiddie might have a somewhat tricky time of it. On the minus side, if the OEM doesn't cave, or is actively hostile, you are also going to have a nasty time of it.

Suitably recent Intel CPUs have 'Intel boot guard'(Just above the middle of page 4). Apparently, in practice, basically all the vendors ship in 'Verified boot' mode. Their public key is fused in to the silicon at the factory; and if the appropriate private key wasn't used to sign the firmware, no dice.

The 'measured boot' capability is a bit more interesting; but largely moot because nobody uses it. I wouldn't put it past an OEM to somehow screw this up; but all reasonably contemporary laptops are not going to take kindly to 3rd party firmware.

What is a Intel E3845 Xeon processor?

the closest thing I found is Intel® Atom Processor E3845 (Bay Trail) http://ark.intel.com/products/...

The older version of the card is indeed an atom processor: BioDigital PC. I can't find anything indicating what the CPU type is in the latest, but I am guessing the BioDigital 7 also uses an Atom processor.

I will say that I have an Ivy Bridge Xeon processor that has a max TDP of 45W. In a fanless configuration, with an SSD, my average power consumption is 8W. I've never gotten it above 15W. This is with multiple VMs running, though I haven't tried to intentionally push it to its limits using something like Passmark. It's very fast for the power usage. I do not believe they make anything below 60W in the more modern architectures, however.

And TFA says nothing about availability; not sure where you got that from.

My guess is he got it from Intel's announcement here: http://newsroom.intel.com/comm...

3D XPoint technology will sample later this year with select customers, and Intel and Micron are developing individual products based on the technology.

- Wireless HDMI (can be expensive to get low latency, doesn't do anything for peripherals)
- Wireless USB hub (can be expensive last I checked, no clue how good it actually is)

I'm starting to think that using these two in tandem is the best I'm gonna get. Ideally there would be a product that bundled them up into one high-quality WiFi connection, but I'm not seeing such a product sadly.

Intel WiDi maybe? https://www-ssl.intel.com/cont...

It seems like there's an opportunity to make a phone that would have much of the Android app availability, but without the usual user-data-pimping. It might take some awareness-raising in the U.S. market, but certainly many EU customers would see the appeal of a competing phone that provided superior privacy and security? Surely significant number of people are fed up with things as they are now?

I guess the big question is, if user data isn't being mined, what is the most financially viable path to offering such a product?
Could one simply sell a replacement OS with some sort of annual support fee that bundles some extra apps of value?
Maybe app-vetting would be a value added service people would pay for? Can existing Android apps be blindly forced to be well-behaved?
Perhaps there could be a market where some government/institutional users mandate such a more private/secure offering.
The stalking of current devices seems like something that could be banned in some jurisdictions.

I don't have too much hope for it ever happening in the U.S., but I think the goals of a viable business and security might be considered worthwhile enough somewhere for a local government subsidy to be considered justifiable.

Maybe the Nokia folks could merge with the Ubuntu folks and look at a wider range of devices. Canonical would have to rethink those recent compromises of privacy however.

I see that there's an Intel Stick-computer offered with Ubuntu. It seems like getting the docs requires agreeing to restrictions that would violate the GPL???

https://downloadcenter.intel.c...

Feel free to check out the intel specifications on the CPU involved. Under memory specifications it says: Max Memory Size (dependent on memory type) 32 GB.

Now I know that theoretically a 64 bit CPU should be able to address 2^64 bytes, which is a very large number indeed. In practicality however I'm guessing they're saving on pins and/or using them for something else.

Depends on the model. Your i7 supports up to 64GB. The first ones IIRC were 24GB.

http://ark.intel.com/products/63697

Of course, that all depends on finding a motherboard that supports an i7 (not a Xeon which is a different socket) actually accepts more than 32GB of ram.

I have Minecraft Vanilla running on a Celeron 887 with the stock Intel graphics on Ubuntu Linux, no less. Sure, it's got a 8GB RAM, but that was because RAM was very cheap when I bought that Celeron. Works just fine...

Oh, my bad, it's THREE years old.
http://ark.intel.com/products/...

Firefox tried to push open video formats, like webm, and refused to support H264.

I know - I argued against that stupid strategy at the time. part of my argument was the same one Mozilla is using now (give up the fight or risk of losing market share).

My solution is still the same: don't ever implement evil or you make the problem worse, do what you can to satisfy market demands by dodging the problem (leave the codec outside of the browser by calling standard OS support (even gstreamer/etc on linux supported h.264 at the time). By ignoring h.264 years ago, Firefox lost users. By adding DRM support, they lost their remaining moral high ground and ability to fight future industry demands. (if they accepted industry demands once, they will do it again in the future).

"plugin" that is very restricted on what it can do

It would be a hasty generalization to assume that this will always be the case. Describing the current implementation does not indicate how it will be implemented in the future. A better extrapolation is that the probability of Mozilla accepting even worse DRM into Firefox in the future is high, because the reasons for accepting it now only grow stronger with time. They wanted to avoid alienating users that supposedly demand Netflix support in the browser. That demand will only increase dramatically when everybody is accustomed to using Netflix in Firefox.

Do you really think Mozilla will put their foot down when the ebook industry gets together with the movie industry to enable text DRM? Or when the plugin changes and requires new holes in the sandbox (e.g. to support Intel's new SGX instructions to create a Trusted Execution Enviornment you cannot access)? You really think that Mozilla will reverse their current behavior, accept the even larger damage to their market share as the Netflix users move to "a browser that works"? No, they will keep paying the industry's demands for danegeld and we lose the free and open web. When lots of the web is wrapped in DRM, do remember that you helped create that future instead of fighting early when the battle was easier.

Well, Intel did establish an R&D center in Moscow based around (some of) the group that designed the Elbrus, and the lead designer Boris Babayan is an Intel Fellow. Buying up Itanium itself, though, wouldn't be much of a win, it's not that much better than Elbrus and Elbrus can natively run x86 code, which is a big win. Add to that the Russians control the IP, why give that up for Itanium? Particularly as the architecture has been used in their military computers for years.

Yes, it's a server/workstation chip .. but as the comment below says, one man's PC is another man's server these days.

No, not really. You are currently able to get more powerful laptops than ever before. Sure, the high-end of the range gets no coverage because the mall retailers don't sell them, and Intel are now focusing their 14nm capacity on where it's most needed, on low-end laptops, tablet, phones and so on. But if you, like me, need more power (actual quad core, high clock speeds, etc) they have plenty to choose from such as these Core i7s. Personally I use an i7-4712HQ, and it does everything I need with great speed - a few VMs, lots of office/browsing applications, SQL development. The 14nm versions of these will come at some point soon which will be as about as fast but have better battery life (or more likely allow smaller/thinner laptops). But they always have and always will provide a higher-power set of processors for those with the need for mobile power. If you need more than that, then there are laptop options with desktop processors, even Xeons such as these. Fiill your boots!

You're wrong in your assumption. The F maxxes out at twice the memory and twice the memory bandwidth, even though both chips have a single channel memory controller.

Z3735F
Z3735G

You're wrong in your assumption. The F maxxes out at twice the memory and twice the memory bandwidth, even though both chips have a single channel memory controller.

Z3735F
Z3735G

Regarding the latin, I had understood you were contradicting me saying "Veni Vidi Vici" was pronounced with a "w" (english) and a hard "k". If you're agreeing with that then we're agreed, in any case Im basing it on the links I provided.

No, it is not. hint: read wikipedia what kerberos is. And: it has nothing to do with windows at all.

Windows' primary selling point is its integration with Active Directory. The primary components of Active Directory are LDAP, Kerberos, and DNS.

It is an add on to the TCP/IP protocol stack, where every single "package" of network data is encrypted/authenticated with a new key from a kerberos authority.

Id argue that its not part of the TCP/IP "stack", as its "application layer" but in any case I dont disagree with THAT.

So it has nothing to do with a session or what ever, has nothing to do with log on (active directory) or what ever

Active directory is the most widespread use of Kerberos. It is used to secure traffic to / from the domain controller, establish logon credentials, authenticate CIFS traffic, and so forth. Obviously Windows does not have a monopoly on it, but in an enterprise environment (or even small business), when you refer to something supporting kerberos, its usually because you're integrating with Active directory.

Thats why if you look up what Intel says regarding kerberos, their second page starts talking about Windows AD.

Im not sure we're disagreeing, really, but you're saying "im wrong" when windows logon is a strong example of what you said (encrypting / authenticating data-- that is how Windows logon sessions authenticate to a domain).

example is the AES-NI instructions, which exist on essentially all modern desktop and laptop CPUs, and many of the newest mobile CPUs as well.

What's the difference between "mobile CPU" and "laptop CPU"? In any case, most 4th generation i3 mobile/laptop CPUs don't support AES-NI, nor do the current Intel Celeron CPUs. Many of those have been released as recently as 2014, so I would count them as "modern".

example is the AES-NI instructions, which exist on essentially all modern desktop and laptop CPUs, and many of the newest mobile CPUs as well.

What's the difference between "mobile CPU" and "laptop CPU"? In any case, most 4th generation i3 mobile/laptop CPUs don't support AES-NI, nor do the current Intel Celeron CPUs. Many of those have been released as recently as 2014, so I would count them as "modern".

https://communities.intel.com/... Greater than 3.10 I am going to aim for 3.14 http://www.slideshare.net/Larr... ( Page 49 )

WTF! you use consumer grade drives and then comment you shop at newegg for your enterprise level equipment?

STFU or tell us where to get an Intel made SLC SSD with a capacity larger than 32gb.

Intel's own SSD sales page is of no use and generally points to either newegg or amazon: http://www.intel.com/buy/us/en...

The Intel X25-E comes can be found in 64gb size ($250 on amazon). The GP would need 83 24gb drives to equal his 2x Samsung EVO drives (I'm guessing he has 2x 1tb EVO's). That'd be 32x 64gb drives. Can we get that number down to a reasonable size using SLC drives? I don't know if you can right now, and I don't know if it's worth it if you can manage to shuffle stuff around in smart ways (ex. for a syslog server, write to the SLC drives, roll onto EVO's, long term onto HDD's, backups on HDD and/or TAPE and/or glacier/etc).

There is some confusion in the article about Po-motion - Lumo is a different application, built in Unity and designed to run on a small processor. We used what we learned developing Po-motion (which is built in AIR) but it is a completely different platform. We'll be providing a styleguide and SDK for Unity developers, and we're planning to support them as they come up with new ideas for the system. The main challenge was making a turnkey unit that parents could afford. I'm excited to see what other people come up with for it. :)

Yes, that is my fault. I read the Po-motion page first and came to the wrong conclusion that your Lumo system was based on Po-motion. I realized my mistake after hitting send, of course. But, as I understand it, you have reduced the hardware of Mandala, an Amiga, a projector, and a camera down to one thing to plug into the wall that provides all of those features and probably a similar level of performance to what was available in 1988 (depending on CPU choice, ARM has come a long way since the 68030 was released). I would love it if one of the Mandala creators were around to pipe up (last I left them they were following the Grateful Dead around the world and living out of Hare Krishna temple/hostels). IIRC, they were also from Canada, though I don't remember which city.

BTW, you should probably update your Lumo page to indicate that you are using an ARM CPU, or perhaps "an Android-compatible CPU", rather than an "Android CPU". As for cost, running Android on an Intel NUC would certainly increase your cost, but could also increase your performance by enough to allow orders of magnitude more challenging applications, maybe for the Hammacher Schlemmer version :P.

The article doesn't say that they're integrated, just the summary. Maybe the mac is internal, but the phy (the power hungry part of ethernet) will be a separate chip. There's no way they stuck it in the cpu, 10G phy silicon is huge and heatsinky [google.com].

Well according to this Intel powerpoint presentation http://download.intel.com/news... by Killeen Kristine it is integrated.
There is some details on the benchmark methods in the fine print but it isn't throughput that they are testing it is concurrent sessions.
Too bad there are no details on "Intel's reference board" so we can see if the heavy silicon is on the motherboard or not.

i3, Pentium G and Celeron are workstation processors?
http://ark.intel.com/search/ad...

Not only i3, also plenty of Pentium Gs and even a bunch of Celerons. Easy to find using the advanced search

Try the Intel Driver Update Utility. Possibly a newer version of the driver for the on-board video would help.

A next step would be to visit the web site of the manufacturer of the motherboard and install any newer versions of the BIOS or chipset drivers.

Sometimes motherboard manufacturers modify the Intel software, so it is necessary to deal with that. For example, the RAID drivers may have been modified.

Yeah, the numbering confused me as well when I first started looking at it, but it does make sense after a bit. You have the model class: i3, i5, and i7 and then you have the model numbers.

The marketting class tells you at a glance (for a given generation) how the CPUs compare: a 2nd gen i7 has more features and generally faster than a 2nd gen i5, etc... Then the model number shows the relative performance/feature within a given generation: 2500 has fewer features or performance than a 2700, etc...

What may not be apparent at first blush is that it is the model number that encodes the generation bit, not the model class. Tthey've gone through 4 generations of Core i7/i5/i3 and the marketting classes haven't changed. The model numbers have changed, though:

Core i7 965 (Nehalem)
Core i7 2700K (Sandy Bridge)
Core i7 3770K (Ivy Bridge)
Core i7 4770K (Haswell)

As you can see, the first digit encodes the generation of chip, with only the original Core i7 generation being the outlier. You can't usually compare across generations, since there are too many variables, though you can crudely estimate that a Zxxx model will be better than a Yxxx model.

The big pain is knowing what features a given chip has and for that you need http://ark.intel.com/

For about a third of the price of your shuttle, I bought the fanless Atom NUC. It's no workhorse but good for basic computing such as slashdot commenting! When I have some free time I'll load openelec and android-x86 on it.

It'd be perfect if Intel added a few extra cores - for 75% more I could have bought the dual core Celeron Brix (also fanless).

I'll definitely look at trading up to the forthcoming Braswell Brix or NUC. The Atom should have reasonable resale value and in the next 6 months I will have saved $AU40 on my power bills!

But yeah I'd be a big fan (pun intended) of a Shuttle at work in preference to a noisy beige tower or a laptop.

Recent Intel processors have the ability to use encrypted RAM and only decrypt it in the CPU's caches. They do it with the SGX instructions.

Kudos for the explanation, this is why I still come to slashdot.

I haven't spent much time looking, so this was the best I could find:

Dell also said accuracy will depend on how far away the object is. From 3 feet to 15 feet, it’s about 98 percent accurate. And from 15 feet to 20 feet its 90 to 93 percent. Beyond 20 feet, it’s too far away to be accurate at all.

The product page doesn't really make this clear at all, the only distance it ever metions is up to 30M and that's in relation to changing the focus.

I'm surprised they made it such a big feature given how limited it is. Might as well just estimate the distances yourself.
 

> Ivy Bridge supports OpenGL 3.3 Not true. Ivy and up support OpenGL 4. See there: http://www.intel.com/support/g...

If you want to write modern OpenCL code and run it on a GPU, AMD is your only option.

In terms of performance, NVIDIA is actually the best. But they've been stuck at OpenCL 1.1 for years, while everyone else has long since moved to newer versions. Until (if) they add OpenCL 2.0 support, they'll be a bad choice.

Intel doesn't support running OpenCL on the GPU under Linux. See the chart at the end of https://software.intel.com/en-.... You can still write OpenCL programs, but you'll just be running them on your CPU.

According to Intel's official page ( http://ark.intel.com/es-es/pro... ), the Intel® Atom Processor Z3580 is based on a 22 nm lithography.

Intel Cherrytrail processors are made on a 14nm process

Sounds a lot like the Intel Compute Stick. maybe not powerful enough for everyone, but for a lot of users, it would be the ideal device. It would be so great to not have to worry about syncing files or even how software licenses transfer between machines when you can put a full powered computer in your pocket.

I wonder, though, if the benchmarks were made using code compiled with an Intel compiler.

http://yro.slashdot.org/story/05/07/12/1320202/amd-alleges-intel-compilers-create-slower-amd-code

Oh, but surely by now they have stopped doing it? Nope:

https://software.intel.com/en-us/articles/optimization-notice

(Isn't it cute how the legal notice is embedded in an image file, so it's hard for search engines to find it?)

It really is true that Intel chips are better than AMD chips now. Intel has fixed the problems in their chips (the Pentium 4 had serious issues) and Intel is two generations ahead on semiconductor process technology.

Intel could be beating AMD fair and square, yet they still engage in the sleazy underhanded practice of making their compiler sabotage the competition.

Intel's remaining chip problems are self-inflicted: they want to maximize the dollars they extract from the customers, so they make a bunch of different chip versions, and different versions have features enabled or not. AMD is #2 and trying harder, so AMD chips always have all features enabled.

So I would be willing to buy one of these AMD-based mini PCs. It will be slower and/or consume more energy than an Intel version; but I just plain don't approve of Intel, and its performance will be adequate. I'm not going to be computing digits of pi on this thing.

P.S. The best thing I can say about Intel: they have cooperated well with the Linux kernel team, and Linux support is great for Intel chipsets including graphics accelerators.

But AMD is doing a pretty good job of cooperating with the Linux kernel guys, and I'd rather give AMD my money.

I have an i5-4690 Which is 3.5Ghz with turbo up to 3.9Ghz, and 84W TDP.

i7-4771 is rated at 3.5Ghz base, turbo of 3.9Ghz, and 84WTDP.

These benchmarks show identical single thread performance:
http://cpuboss.com/cpus/Intel-...
https://www.cpubenchmark.net/s...
i7-4771-2,229
i5-4690-2,228

I have an i5-4690 Which is 3.5Ghz with turbo up to 3.9Ghz, and 84W TDP.

i7-4771 is rated at 3.5Ghz base, turbo of 3.9Ghz, and 84WTDP.

These benchmarks show identical single thread performance:
http://cpuboss.com/cpus/Intel-...
https://www.cpubenchmark.net/s...
i7-4771-2,229
i5-4690-2,228

OK then. Where in this return statement are the lower 32 bits read first? I don't believe the bitwise or operator is a sequence point. (The logical one is)

return readl(addr) | (((unsigned long long)readl(addr + 4)) http://www.intel.com/hardwared...

but I did find the following, which documents the race condition I explained above.

http://www.intel.com/content/d...

I will search for newer documentation than a 1.0a.

OK then. Where in this return statement are the lower 32 bits read first? I don't believe the bitwise or operator is a sequence point. (The logical one is)

return readl(addr) | (((unsigned long long)readl(addr + 4)) http://www.intel.com/hardwared...

but I did find the following, which documents the race condition I explained above.

http://www.intel.com/content/d...

I will search for newer documentation than a 1.0a.

Yes it's pretty clearly outlined on the website:

Intel® Turbo Boost Technology 2.01 accelerates processor and graphics performance for peak loads, automatically allowing processor cores to run faster than the rated operating frequency if they’re operating below power, current, and temperature specification limits.

Note: Intel Turbo Boost Technology 2.0 allows the processor to operate at a power level that is higher than its TDP configuration and data sheet specified power for short durations to maximize performance.
http://www.intel.com/content/www/us/en/architecture-and-technology/turbo-boost/turbo-boost-technology.html

And keeping them below those temperature specification limits 24/7 with maximum load is not something that is achievable in a laptop.

If Israel sold rockets to the Palestinians, the rockets would be used against Israel and Israelis would die. You don't get your citizens killed for money.

If Intel sold fab capacity to a competitor, it might hurt Intel's own CPU sales. But lost money can be made up for with other money. For the right price, why wouldn't Intel do this? Particularly as Intel has an interest in keeping companies like AMD alive to avoid antitrust action, while Intel is looking for customers for its custom foundry.

You are incorrect:
http://newsroom.intel.com/comm...

I do not know everything they've announced, but there is definitely more of their best stuff coming.

By design, you will not find a single Intel Pentium or Core that supports ECC.

Wrong.

Yes, you need a board with a Cwhatever chipset to get a BIOS that can enable ECC.
Partially a forced chipset limitation (ECC for the DMI link and the chipset PCIe lanes is permanently fused off on the desktop chipsets).
Partially pure segmentation bullshit (Sandy Bridge onwands main memory ECC including error reporting is completely handled on cpu, yet board manufacturers are not allowed to enable even that on non-workstation boards if they want to get any intel chipsets in the future...)

Sidenote:
intel requires a NDA to get a datasheet that contains the finer details of the CPU memory controller, including how to set up and control ECC.
AMD has full memory controller info in their public datasheets.
Guess which linux EDAC driver still can't properly decode error syndromes.

Something is not right here... The Q8200 is 64bit capable (as are most Core 2 Quad's) - http://ark.intel.com/products/...

Also you mention you have 8GB RAM, so unless you're 100% sure you are using a PAE enabled 32bit kernel, you won't be using 8GB of RAM effectively if you have a 32bit kernel running. (Since 32bit kernels without PAE can only address 4GB).

The only thing the Q8200 lacks is VT-x, but for a FreeNAS (or any storage server) setup that's a mute point...

You might to double check you hardware and setup...