Nginx QAT - #48
Conversation
Add the NGINX + Intel QAT workload guide covering hardware and software prerequisites, async-mode-nginx build and configuration, and CPS benchmarking results. Includes the with/without QAT configuration pair used for the comparison and the openssl s_time driver script for the handshake test.
Updates to instance section in Details.
Replace the CPS chart with a version that drops the C3 SPR bar, so every bar plotted has a corresponding configuration disclosure. Update the Results text to reference the Xeon 6985P (c4-highmem-288-metal) rather than the 6980P, matching the Details section, and reword the worker_processes note so it no longer implies a specific core-count ratio. Correct the C4D entry to say Turin rather than GNR and drop QATEngine from its software list, since QAT is not available on that platform.
There was a problem hiding this comment.
Please add a link to this article from the main Optimization Zone landing page
There was a problem hiding this comment.
Would it make sense to put this README in a directory called "QAT" and have a general Nginx landing page README? I'm thinking in the future there might be non-QAT optimization entries that we will probably want on the main landing page. Reference the "cassandra" Optimization Zone entry.
There was a problem hiding this comment.
Proposed structure:
software/nginx
- QAT
-
- images
-
-
- nginx_qat_comparison_intel_amd.png
-
-
- supporting_files
-
-
- connection_test
-
-
-
- nginx_with_qat.conf
-
-
-
- nginx_without_qat.conf
-
-
- README.md (the current README)
- README.md (a new README that points to the QAT NGINX article)
| sudo modprobe qat_4xxx | ||
| ``` | ||
|
|
||
| If the kernel modules could not be installed, it might be needed to either install them through a kernel configuration or to install them with the distribution's package manager. |
There was a problem hiding this comment.
Is there documentation for what this process would look like? Does qatlib have this documented and we can point to it?
| | `sym;dc` | Symmetric crypto and compression | | ||
| | `asym;dc` | Asymmetric crypto and compression | | ||
|
|
||
| This matters because the two optimizations in this guide use different services. The qatzip module (`ngx_http_qatzip_filter_module`) needs `dc`, while QATEngine handling TLS handshakes (`ngx_ssl_engine_qat_module`) needs the crypto services. A device left at the compression-only default will not accelerate TLS, and the CPS results below cannot be reproduced on it. |
There was a problem hiding this comment.
| This matters because the two optimizations in this guide use different services. The qatzip module (`ngx_http_qatzip_filter_module`) needs `dc`, while QATEngine handling TLS handshakes (`ngx_ssl_engine_qat_module`) needs the crypto services. A device left at the compression-only default will not accelerate TLS, and the CPS results below cannot be reproduced on it. | |
| This matters because the two optimizations in this guide use different services. The qatzip module (`ngx_http_qatzip_filter_module`) needs `dc`, while QATEngine handling TLS handshakes (`ngx_ssl_engine_qat_module`) needs the crypto services. A device left at the compression-only default will not accelerate TLS, and the Connections Per Second (CPS) results below cannot be reproduced on it. |
| [async-mode-nginx](https://github.com/intel/asynch_mode_nginx) can be built with: | ||
|
|
||
| ``` | ||
| ./configure \ |
There was a problem hiding this comment.
I think it would make sense to have a note here before the code snippet that the user will need certain environment variables exported in order for the command to work. They might need guidance about what QZ_ROOT and ICP_ROOT are.
There was a problem hiding this comment.
please put this in a directory called "images" and make the name more descriptive. E.g. nginx_qat_comparison_intel_amd.png
There was a problem hiding this comment.
Pull request overview
Adds an NGINX + Intel® QAT optimization/benchmarking bundle under software/nginx, including documentation, sample configs (with/without QAT), and a CPS measurement script to compare baseline vs QAT-accelerated TLS.
Changes:
- Added a detailed QAT setup + async-mode-nginx build/benchmark guide (
README.md). - Added two NGINX configuration examples for baseline and QAT-enabled runs (
nginx_without_qat.conf,nginx_with_qat.conf). - Added a CPS benchmarking helper script based on
openssl s_time(connection_test.sh).
Reviewed changes
Copilot reviewed 4 out of 5 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| software/nginx/README.md | Documents QAT requirements, setup, and benchmark methodology/results. |
| software/nginx/nginx_without_qat.conf | Baseline async-mode-nginx config with QAT modules disabled. |
| software/nginx/nginx_with_qat.conf | QAT-enabled async-mode-nginx config loading QAT modules/engine and qatzip settings. |
| software/nginx/connection_test.sh | Script to run parallel openssl s_time clients and compute aggregate CPS. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| rm -rf ./.test_* | ||
|
|
||
| # Get starttime | ||
| starttime=$(date +\%s) |
| starttime=$(date +\%s) | ||
|
|
||
| # Kick off the tests after checking for emulation | ||
| if [[ $emulation -eq 1 ]] |
| # wait until all processes complete | ||
| # The bracketed first character keeps grep from matching its own command line. | ||
| while [ $(ps -ef | grep -c "[o]penssl s_time") != 0 ]; | ||
| do | ||
| sleep 1 | ||
| done |
| ``` | ||
| echo `(lspci -d 8086:4940 && lspci -d 8086:4941 && lspci -d 8086:4942 && lspci -d 8086:4943 && lspci -d 8086:4944 && lspci -d 8086:4945 && lspci -d 8086:4946 && lspci -d 8086:4947) | wc -l` supported devices found. | ||
| ``` |
NGINX with QAT support added comparing GNR, GNR with QAT and Turin.