intel/intel-qat-engine

Introduction

Intel QuickAssist Technology (QAT) OpenSSL Engine is an OpenSSL Plug-In Engine that provides ***graphic acceleration for both hardware and optimized software using Intel QuickAssist Technology enabled Intel platforms.

Docker Image

• intel/intel-qat-engine:2.0.0-1

How to Use This Image

BIOS Setting

• Intel VT-d and SR-IOV must be enabled in the platform (BIOS). For more details, refer to the link Updating the BIOS settings.

Grub Settings

• Intel IOMMU should be enabled and QAT VF to be bind to kernel. Follow the below steps.

Ubuntu:

• Edit the grub file: sudo vim /etc/default/grub
• Modify GRUB_CMDLINE_LINUX to add intel_iommu=on vfio-pci.ids=8086:4941 (SPR)
• Update grub: sudo update-grub
• Reboot the system

CentOS/Fedora:

• Update the kernel: grubby --update-kernel=/boot/vmlinuz-$(uname -r) --remove-args="intel_iommu=on" --args="intel_iommu=off vfio-pci.ids=8086:4941"

• Reboot the system

• Ensure VT-d and SRIOV are enabled in the host. The steps can be referred from the link Configuring the host operating system with SR-IOV IOMMU.

Docker Environment Setup

• The environment must be set up to build and run containers. Certain packages will need to be loaded and configuration files created and/or updated, which can be system specific.
• Install Docker following the steps in Docker Package Installation.
• Configure the proxy setting following Proxy settings.

Enable Intel® QAT Virtual Function (VF) Devices

• Enable the VF devices using the following script:

  sh
  for i in `(lspci -D -d :4940 || lspci -D -d :4942) | awk '{print $1}'`; do echo 16 | sudo tee /sys/bus/pci/devices/$i/sriov_numvfs; done
  

Configure Services in the Host

• Stop the Intree or OOT services if any running on the host:

  sh
  systemctl stop qat
  

  sh
  systemctl stop qat_service
  

  sh
  systemctl disable qat_service
  

• Bring the QAT device down:

  sh
  for i in `lspci -D -d :4940 | awk '{print $1}'`; do echo down > /sys/bus/pci/devices/$i/qat/state; done
  

• Set the correct service in the QAT devices:

  sh
  for i in `lspci -D -d :4940 | awk '{print $1}'`; do echo "sym;asym" > /sys/bus/pci/devices/$i/qat/cfg_services; done
  

• Bring the QAT device up:

  sh
  for i in `lspci -D -d :4940 | awk '{print $1}'`; do echo up > /sys/bus/pci/devices/$i/qat/state; done
  

• Check the status:

  sh
  for i in `lspci -D -d :4940 | awk '{print $1}'`; do cat /sys/bus/pci/devices/$i/qat/state; done
  

• Ensure the GID using the below command in host. The GID of the QAT group on the host should be same as GID of the docker Image. The QAT group of the host should be ‘1001’ :

  sh
  getent group qat | cut -d ':' -f 3
  

• Enable the VF devices with the previously mentioned script and set correct permissions:

  sh
  chown root:qat /dev/vfio/*
  

  sh
  chmod 660 /dev/vfio/*
  

Run Image

To run the Docker image, use the following command:

sh
docker run -it --cap-add=IPC_LOCK --security-opt seccomp=unconfined --security-opt apparmor=unconfined $(for i in `ls /dev/vfio/*`; do echo --device $i; done) --cpuset-cpus <n cores> --env QAT_POLICY=1 --ulimit memlock=50000000:50000000 intel/intel-qat-engine:1.8.1-1 openssl speed -engine qatengine -elapsed -async_jobs 72 -multi <n> <algo>

Note: n is the number of processes.

Sample Test Output

sh
docker run -it --cap-add=IPC_LOCK --security-opt seccomp=unconfined --security-opt apparmor=unconfined $(for i in `ls /dev/vfio/*`; do echo --device $i; done) --cpuset-cpus 0-63 --env QAT_POLICY=1 --ulimit memlock=524288000:524288000 amr-fm-registry.caas.intel.com/esh-user/qat_crypto_base:1.8.1 openssl speed -engine qatengine -elapsed -async_jobs 72 -multi 64 rsa2048

sh
version: 3.0.15
built on: Thu Feb 13 08:57:33 2025 UTC
options: bn(64,64)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG
CPUINFO: OPENSSL_ia32cap=0x7ffef3ffffebffff:0xfb417ffef3bfb7ef
                  sign    verify    sign/s verify/s
rsa 2048 bits 0.000012s 0.000001s  80615.1 1069738.5

Legal

Intel, Intel Atom, and Xeon are trademarks of Intel Corporation in the U.S. and/or other countries.

*Other names and brands may be claimed as the property of others.

Copyright © 2025, Intel Corporation. All rights reserved.