Skip to main content

​
Overview

QAT Engine supports various crypto libraries and QAT generations with both hardware and software acceleration. This guide covers building from source for different configurations.

​
Clone the Repository

1

Clone QAT Engine

git clone https://github.com/intel/QAT_Engine.git
cd QAT_Engine
Before proceeding, ensure you have installed the required prerequisites:
  • autoconf
  • automake
  • libtool
  • pkg-config

​
Build with Make Depend Target

The make depend target automatically clones and builds dependent libraries (OpenSSL, QAT_HW, QAT_SW) based on your configure flags.
1

Initialize submodules

git submodule update --init
2

Run autogen

./autogen.sh
3

Configure the build

./configure \
  --with-qat_hw_dir=/QAT \
  --enable-qat_sw \
  --with-openssl_install_dir=/usr/local/ssl
  • --with-qat_hw_dir: Only needed for QAT_HW platforms
  • --enable-qat_sw: Only needed for QAT_SW platforms
  • --with-openssl_install_dir: Optional, uses system OpenSSL if omitted
4

Build dependencies and engine

make depend
make
make install
Limitations of make depend:
  • Not supported on FreeBSD OS
  • Not supported in virtualized environments
  • Not supported for BoringSSL or BabaSSL
  • Not supported for qatlib dependency builds

​
What make depend does

  • Clones dependent libraries to appropriate versions
  • Installs QAT_HW driver to /QAT
  • Installs QAT_SW to default paths:
    • cryptography-primitives: /usr/local
    • ipsec_mb: /usr
  • Installs qatengine.so to OpenSSL engines directory

​
Manual Installation

For more control over the build process, install prerequisites manually before building.

​
Install OpenSSL

1

Clone OpenSSL

git clone https://github.com/openssl/openssl.git
cd openssl
2

Checkout desired version

git checkout openssl-3.0.14  # or latest stable tag
Use a version from the supported list.
3

Configure and build

./config --prefix=/usr/local/ssl -Wl,-rpath,/usr/local/ssl/lib64
make
sudo make install
4

Set environment variable

export OPENSSL_ENGINES=/usr/local/ssl/lib64/engines-3
Add this to your .bashrc or .profile for persistence.
If you prefer Tongsuo instead of OpenSSL:
git clone https://github.com/Tongsuo-Project/Tongsuo.git
cd Tongsuo
git checkout 8.4.0
./config --prefix=/usr/local/ssl -Wl,-rpath,/usr/local/ssl/lib64
make
sudo make install

​
Install QAT Hardware Dependencies

Install the QAT Hardware driver from the Getting Started Guide for your device:

Intel QuickAssist Technology

Download drivers for QAT 1.x or QAT 2.x devices
USDM Component Configuration:For multi-thread use cases, enable lockless thread-specific memory:
./configure --enable-icp-thread-specific-usdm --enable-128k-slab
make
sudo make install
QAT gen4 devices (4xxx) support Shared Virtual Memory for zero-copy operations:Prerequisites:
  • Enable in BIOS:
    • Support for Shared Virtual Memory with Intel IOMMU
    • Enable VT-d
    • Enable ATS
Driver Configuration (OOT driver only):Set in QAT device config files:
SvmEnabled = 1
ATEnabled = 1
SVM is only available with OOT driver packages, not qatlib in-tree driver.

​
Install QAT Software Dependencies

1

Install Crypto Multi-buffer

git clone https://github.com/intel/cryptography-primitives.git
cd cryptography-primitives/sources/ippcp/crypto_mb
cmake . -B_build -DCMAKE_INSTALL_PREFIX=/usr/local
cmake --build _build
sudo cmake --install _build
Newer versions install to /usr/local/lib/intel64. Copy libraries to /usr/local/lib:
sudo cp /usr/local/lib/intel64/*.so* /usr/local/lib/
2

Install IPsec Multi-buffer

git clone https://github.com/intel/intel-ipsec-mb.git
cd intel-ipsec-mb
make
sudo make install PREFIX=/usr

​
Build QAT Engine for QAT_HW

1

Configure

cd /QAT_Engine
./autogen.sh
./configure \
  --with-qat_hw_dir=/QAT \
  --with-openssl_install_dir=/usr/local/ssl
Omit --with-openssl_install_dir to use system OpenSSL.
2

Build and install

make
sudo make install
3

Update QAT driver config

./update_config.sh multi_thread
# or for multi-process:
# ./update_config.sh multi_process asym 1 64 0
Arguments:
  • <Mode>: multi_process or multi_thread
  • <ServicesEnabled>: 'asym;sym', 'asym', 'sym', 'asym;dc', 'sym;dc'
  • <NumberCyInstances>: Number of crypto instances
  • <NumProcesses>: Number of processes
  • <LimitDevAccess>: 0 or 1

​
Build QAT Engine for QAT_SW

1

Configure

cd /QAT_Engine
./autogen.sh
./configure --enable-qat_sw
If QAT_HW qatlib is installed and you want QAT_SW only:
./configure --enable-qat_sw --disable-qat_hw
2

Build and install

make
sudo make install
If crypto_mb or ipsec_mb are installed to custom locations:
./configure \
  --enable-qat_sw \
  --with-qat_sw_crypto_mb_install_dir=/custom/path \
  --with-qat_sw_ipsec_mb_install_dir=/custom/path

​
Build QAT Engine with QAT_HW & QAT_SW Co-existence

1

Configure for co-existence

cd /QAT_Engine
./autogen.sh
./configure \
  --with-qat_hw_dir=/QAT \
  --enable-qat_sw \
  --with-openssl_install_dir=/usr/local/ssl
2

Build and install

make
sudo make install

Co-existence Behavior

Learn about the default behavior and working mechanism of QAT_HW and QAT_SW co-existence

​
Verification

After installation, verify the engine is working: 
openssl engine -t -c qatengine
Expected output: 
(qatengine) Intel QuickAssist Technology Engine
     [RSA, DSA, DH, AES-128-CBC-HMAC-SHA1, ...]
     [ available ]
For detailed configuration options, see the Build Options reference.

​
Next Steps

Build Options

Explore all available configure flags

Configuration

Configure QAT Engine runtime behavior

Build docs developers (and LLMs) love

Get started for freeTalk to us