Get started with EFA and NIXL for inference workloads on Amazon EC2

The NVIDIA Inference Xfer Library (NIXL) is a high-throughput, low-latency communication library designed specifically for disaggregated inference workloads. NIXL can be used together with EFA and Libfabric to support KV-cache transfer between prefill and decode nodes, and it enables efficient KV-cache movement between various storage layers. For more information, see the NIXL website.

Requirements

Only Ubuntu 24.04 and Ubuntu 22.04 base AMIs are supported.
EFA supports only NIXL 1.0.0 and later.

Steps

An EFA requires a security group that allows all inbound and outbound traffic to and from the security group itself. The following procedure creates a security group that allows all inbound and outbound traffic to and from itself, and that allows inbound SSH traffic from any IPv4 address for SSH connectivity.

Important

This security group is intended for testing purposes only. For your production environments, we recommend that you create an inbound SSH rule that allows traffic only from the IP address from which you are connecting, such as the IP address of your computer, or a range of IP addresses in your local network.

For other scenarios, see Security group rules for different use cases.

To create an EFA-enabled security group

Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
In the navigation pane, choose Security Groups and then choose Create security group.
In the Create security group window, do the following:
1. For Security group name, enter a descriptive name for the security group, such as EFA-enabled security group.
2. (Optional) For Description, enter a brief description of the security group.
3. For VPC, select the VPC into which you intend to launch your EFA-enabled instances.
4. Choose Create security group.
Select the security group that you created, and on the Details tab, copy the Security group ID.
With the security group still selected, choose Actions, Edit inbound rules, and then do the following:
1. Choose Add rule.
2. For Type, choose All traffic.
3. For Source type, choose Custom and paste the security group ID that you copied into the field.
4. Choose Add rule.
5. For Type, choose SSH.
6. For Source type, choose Anywhere-IPv4.
7. Choose Save rules.
With the security group still selected, choose Actions, Edit outbound rules, and then do the following:
1. Choose Add rule.
2. For Type, choose All traffic.
3. For Destination type, choose Custom and paste the security group ID that you copied into the field.
4. Choose Save rules.

Important

The self-referencing inbound and outbound rules (allowing all traffic to and from the security group itself) are mandatory for EFA to function. Without these rules, EFA traffic between instances will be blocked.

Launch a temporary instance that you can use to install and configure the EFA software components. You use this instance to create an EFA-enabled AMI from which you can launch your EFA-enabled instances.

To launch a temporary instance

Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
In the navigation pane, choose Instances, and then choose Launch Instances to open the new launch instance wizard.
(Optional) In the Name and tags section, provide a name for the instance, such as EFA-instance. The name is assigned to the instance as a resource tag (Name=EFA-instance).
In the Application and OS Images section, select an AMI for one of the supported operating systems. You can also select a supported DLAMI found on the DLAMI Release Notes Page.
In the Instance type section, select a supported instance type.
In the Key pair section, select the key pair to use for the instance.
In the Network settings section, choose Edit, and then do the following:
1. For Subnet, choose the subnet in which to launch the instance. If you do not select a subnet, you can't enable the instance for EFA.
2. For Firewall (security groups), choose Select existing security group, and then select the security group that you created in the previous step.
3. Expand the Advanced network configuration section.
  
  For Network interface 1, select Network card index = 0, Device index = 0, and Interface type = EFA with ENA.
  
  (Optional) If you are using a multi-card instance type, such as p4d.24xlarge or p5.48xlarge, for each additional network interface required, choose Add network interface, for Network card index select the next unused index, and then select Device index = 1 and Interface type = EFA with ENA or EFA-only.
In the Storage section, configure the volumes as needed.

Note
You must provision an additional 10 to 20 GiB of storage for the Nvidia CUDA Toolkit. If you do not provision enough storage, you will receive an insufficient disk space error when attempting to install the Nvidia drivers and CUDA toolkit.
In the Summary panel on the right, choose Launch instance.

Important

Skip Step 3 if your AMI already includes Nvidia GPU drivers, the CUDA toolkit, and cuDNN, or if you are using a non-GPU instance.

To install the Nvidia GPU drivers, Nvidia CUDA toolkit, and cuDNN

To ensure that all of your software packages are up to date, perform a quick software update on your instance.
```
$ sudo apt-get update && sudo apt-get upgrade -y
```
Install the utilities that are needed to install the Nvidia GPU drivers and the Nvidia CUDA toolkit.
```
$ sudo apt-get install build-essential -y
```
To use the Nvidia GPU driver, you must first disable the nouveau open source drivers.
1. Install the required utilities and the kernel headers package for the version of the kernel that you are currently running.
```
$ sudo apt-get install -y gcc make linux-headers-$(uname -r)
```
2. Add nouveau to the /etc/modprobe.d/blacklist.conf deny list file.
```
$ cat << EOF | sudo tee --append /etc/modprobe.d/blacklist.conf
blacklist vga16fb
blacklist nouveau
blacklist rivafb
blacklist nvidiafb
blacklist rivatv
EOF
```
3. Open /etc/default/grub using your preferred text editor and add the following.
```
GRUB_CMDLINE_LINUX="rdblacklist=nouveau"
```
4. Rebuild the Grub configuration.
```
$ sudo update-grub
```
Reboot the instance and reconnect to it.

Add the CUDA repository and install the Nvidia GPU drivers, NVIDIA CUDA toolkit, and cuDNN.


$ sudo apt-key adv --fetch-keys http://developer.download.nvidia.com/compute/machine-learning/repos/ubuntu2004/x86_64/7fa2af80.pub \
&& wget -O /tmp/deeplearning.deb http://developer.download.nvidia.com/compute/machine-learning/repos/ubuntu2004/x86_64/nvidia-machine-learning-repo-ubuntu2004_1.0.0-1_amd64.deb \
&& sudo dpkg -i /tmp/deeplearning.deb \
&& wget -O /tmp/cuda.pin https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2004/x86_64/cuda-ubuntu2004.pin \
&& sudo mv /tmp/cuda.pin /etc/apt/preferences.d/cuda-repository-pin-600 \
&& sudo apt-key adv --fetch-keys https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2004/x86_64/3bf863cc.pub \
&& sudo add-apt-repository 'deb http://developer.download.nvidia.com/compute/cuda/repos/ubuntu2004/x86_64/ /' \
&& sudo apt update \
&& sudo apt install nvidia-dkms-535 \
&& sudo apt install -o Dpkg::Options::='--force-overwrite' cuda-drivers-535 cuda-toolkit-12-3 libcudnn8 libcudnn8-dev -y

Reboot the instance and reconnect to it.
(p4d.24xlarge and p5.48xlarge only) Install the Nvidia Fabric Manager.
1. You must install the version of the Nvidia Fabric Manager that matches the version of the Nvidia kernel module that you installed in the previous step.
  
  Run the following command to determine the version of the Nvidia kernel module.
```
$ cat /proc/driver/nvidia/version | grep "Kernel Module"
```
  The following is example output.
```
NVRM version: NVIDIA UNIX x86_64 Kernel Module  450.42.01  Tue Jun 15 21:26:37 UTC 2021
```
  In the example above, major version 450 of the kernel module was installed. This means that you need to install Nvidia Fabric Manager version 450.
2. Install the Nvidia Fabric Manager. Run the following command and specify the major version identified in the previous step.
```
$ sudo apt install -o Dpkg::Options::='--force-overwrite' nvidia-fabricmanager-major_version_number
```
  For example, if major version 450 of the kernel module was installed, use the following command to install the matching version of Nvidia Fabric Manager.
```
$ sudo apt install -o Dpkg::Options::='--force-overwrite' nvidia-fabricmanager-450
```
3. Start the service, and ensure that it starts automatically when the instance starts. Nvidia Fabric Manager is required for NV Switch Management.
```
$ sudo systemctl start nvidia-fabricmanager && sudo systemctl enable nvidia-fabricmanager
```

Ensure that the CUDA paths are set each time that the instance starts.

For bash shells, add the following statements to /home/username/.bashrc and /home/username/.bash_profile.


export PATH=/usr/local/cuda/bin:$PATH
export LD_LIBRARY_PATH=/usr/local/cuda/lib64:/usr/local/cuda/extras/CUPTI/lib64:$LD_LIBRARY_PATH

For tcsh shells, add the following statements to /home/username/.cshrc.


setenv PATH=/usr/local/cuda/bin:$PATH
setenv LD_LIBRARY_PATH=/usr/local/cuda/lib64:/usr/local/cuda/extras/CUPTI/lib64:$LD_LIBRARY_PATH

To confirm that the Nvidia GPU drivers are functional, run the following command.
```
$ nvidia-smi -q | head
```
The command should return information about the Nvidia GPUs, Nvidia GPU drivers, and Nvidia CUDA toolkit.

Important

Skip Step 4 if your AMI already includes GDRCopy, or if you are using a non-GPU instance.

Install GDRCopy to improve the performance of Libfabric on GPU-based platforms. For more information about GDRCopy, see the GDRCopy repository.

To install GDRCopy

Install the required dependencies.


$ sudo apt -y install build-essential devscripts debhelper check libsubunit-dev fakeroot pkg-config dkms

Download and extract the GDRCopy package.


$ wget https://github.com/NVIDIA/gdrcopy/archive/refs/tags/v2.4.tar.gz \
&& tar xf v2.4.tar.gz \
&& cd gdrcopy-2.4/packages

Build the GDRCopy DEB packages.


$ CUDA=/usr/local/cuda ./build-deb-packages.sh

Install the GDRCopy DEB packages.


$ sudo dpkg -i gdrdrv-dkms_2.4-1_amd64.*.deb \
&& sudo dpkg -i libgdrapi_2.4-1_amd64.*.deb \
&& sudo dpkg -i gdrcopy-tests_2.4-1_amd64.*.deb \
&& sudo dpkg -i gdrcopy_2.4-1_amd64.*.deb

Important

Skip Step 5 if your AMI already includes the latest EFA installer.

Install the EFA-enabled kernel, EFA drivers, and Libfabric stack that is required to support EFA on your instance.

To install the EFA software

Connect to the instance you launched. For more information, see Connect to your Linux instance using SSH.
Download the EFA software installation files. The software installation files are packaged into a compressed tarball (.tar.gz) file. To download the latest stable version, use the following command.
```
$ curl -O https://efa-installer.amazonaws.com/aws-efa-installer-1.50.0.tar.gz
```
Extract the files from the compressed .tar.gz file, delete the tarball, and navigate into the extracted directory.
```
$ tar -xf aws-efa-installer-1.50.0.tar.gz && rm -rf aws-efa-installer-1.50.0.tar.gz && cd aws-efa-installer
```
(Optional) Verify individual package signatures during installation.

Starting with EFA installer 1.48.0, the installer includes GPG-signed individual RPM and DEB packages. To verify the authenticity and integrity of each individual package during installation, use the --check-signatures flag. When you enable this flag, the installer verifies all package signatures first, and only proceeds with installation if every package passes verification. If any package fails verification, the installer exits immediately without installing anything.
1. Download the GPG public key.
```
$ wget https://efa-installer.amazonaws.com/aws-efa-installer.key
```
2. Export the key path. Then, in the next step, append --check-signatures to the installation command and use sudo -E instead of sudo to preserve the environment variable.
```
$ export EFA_INSTALLER_KEY=$(pwd)/aws-efa-installer.key
```
On RPM-based systems (Amazon Linux, RHEL, Rocky Linux, and SUSE), the installer verifies each RPM using rpm --checksig. On DEB-based systems (Ubuntu, Debian), the installer verifies each DEB using GPG signature verification.

If verification of any package fails, the installation immediately aborts, protecting your system against broken or malicious packages.

Note
The --check-signatures flag is optional. Without it, the installer does not perform individual signature verification.
Show moreShow less
Run the EFA software installation script.

Note
If you completed the previous optional step to set up package signature verification, append --check-signatures to the installation command and use sudo -E instead of sudo. For example: sudo -E ./efa_installer.sh -y --check-signatures.
```
$ sudo ./efa_installer.sh -y
```
Libfabric is installed in the /opt/amazon/efa directory.
If the EFA installer prompts you to reboot the instance, do so and then reconnect to the instance. Otherwise, log out of the instance and then log back in to complete the installation.

Confirm that the EFA software components were successfully installed.


$ fi_info -p efa -t FI_EP_RDM

The command should return information about the Libfabric EFA interfaces. The following example shows the command output.

p3dn.24xlarge with single network interface


provider: efa
fabric: EFA-fe80::94:3dff:fe89:1b70
domain: efa_0-rdm
version: 2.0
type: FI_EP_RDM
protocol: FI_PROTO_EFA

p4d.24xlarge and p5.48xlarge with multiple network interfaces


provider: efa
fabric: EFA-fe80::c6e:8fff:fef6:e7ff
domain: efa_0-rdm
version: 111.0
type: FI_EP_RDM
protocol: FI_PROTO_EFA
provider: efa
fabric: EFA-fe80::c34:3eff:feb2:3c35
domain: efa_1-rdm
version: 111.0
type: FI_EP_RDM
protocol: FI_PROTO_EFA
provider: efa
fabric: EFA-fe80::c0f:7bff:fe68:a775
domain: efa_2-rdm
version: 111.0
type: FI_EP_RDM
protocol: FI_PROTO_EFA
provider: efa
fabric: EFA-fe80::ca7:b0ff:fea6:5e99
domain: efa_3-rdm
version: 111.0
type: FI_EP_RDM
protocol: FI_PROTO_EFA

Install NIXL. For more information about NIXL, see the NIXL repository.

Install the NIXL Benchmark and run a test to ensure that your temporary instance is properly configured for EFA and NIXL. The NIXL Benchmark enables you to confirm that NIXL is properly installed and that it is operating as expected. For more information, see the nixlbench repository.

NIXL Benchmark (nixlbench) requires ETCD for coordination between client and server. To use ETCD with NIXL requires ETCD Server and Client, and ETCD CPP API.

Build from Docker

To install and test NIXL Benchmark using Docker

Clone the official NIXL repository to the instance and navigate to the nixlbench build directory.
```
$ git clone https://github.com/ai-dynamo/nixl.git
$ cd nixl/benchmark/nixlbench/contrib
```
Build the container.
```
$ ./build.sh
```
For more information about Docker build options, see the nixlbench repository.
Install Docker.
```
$ sudo apt install docker.io -y
```

Start the ETCD server for coordination.


$ docker run -d --name etcd-server \
    -p 2379:2379 -p 2380:2380 \
    quay.io/coreos/etcd:v3.5.18 \
    /usr/local/bin/etcd \
    --data-dir=/etcd-data \
    --listen-client-urls=http://0.0.0.0:2379 \
    --advertise-client-urls=http://0.0.0.0:2379 \
    --listen-peer-urls=http://0.0.0.0:2380 \
    --initial-advertise-peer-urls=http://0.0.0.0:2380 \
    --initial-cluster=default=http://0.0.0.0:2380

Validate that the ETCD server is running.
```
$ curl -L http://localhost:2379/health
```
Expected output:
```
{"health":"true"}
```
Open two terminals for the instance. On both terminals, run the following command to verify the installation. The command uses the ETCD server on the same instance, uses Libfabric as the backend, and operates using GPU memory.
```
$ docker run -it --gpus all --network host nixlbench:latest \
    nixlbench --etcd_endpoints http://localhost:2379 \
    --backend LIBFABRIC \
    --initiator_seg_type VRAM \
    --target_seg_type VRAM
```
Note
Use the value DRAM instead of VRAM for non-GPU instances.

Build from source

Important

Follow this tab only if you chose Build from source in Step 6.

To install NIXL Benchmark

Install the required system dependencies.
```
$ sudo apt install libgflags-dev
```

Install ETCD Server and Client.


$ sudo apt install -y etcd-server etcd-client

Install the ETCD CPP API.

Install the required dependencies for ETCD CPP API.


$ sudo apt install libboost-all-dev libssl-dev libgrpc-dev libgrpc++-dev libprotobuf-dev protobuf-compiler-grpc libcpprest-dev

Clone and install ETCD CPP API.


$ cd $HOME
$ git clone https://github.com/etcd-cpp-apiv3/etcd-cpp-apiv3.git
$ cd etcd-cpp-apiv3
$ mkdir build && cd build
$ cmake ..
$ sudo make -j$(nproc) && sudo make install

Build and install nixlbench.


$ sudo meson setup . $HOME/nixl/benchmark/nixlbench -Dnixl_path=/usr/local/nixl/
$ sudo ninja && sudo ninja install

To test your EFA and NIXL configuration

Start the ETCD server on the instance.


$ etcd --listen-client-urls "http://0.0.0.0:2379" \
    --advertise-client-urls "http://localhost:2379" &

Validate that the ETCD server is running.
```
$ curl -L http://localhost:2379/health
```
Expected output:
```
{"health":"true"}
```
Open two terminals for the instance. On both terminals, complete the following steps to run nixlbench.
1. Navigate to the directory where nixlbench is installed.
```
$ cd /usr/local/nixlbench/bin/
```
2. Run the test and specify the backend, address of the ETCD server, and initiator segment type. The following command uses the ETCD server on the same instance, uses Libfabric as the backend, and operates using GPU memory. The environment variables configure the following:
  - NIXL_LOG_LEVEL=INFO — Enables detailed debugging output. You can also specify WARN to receive only error messages.
  - LD_LIBRARY_PATH — Sets the path for the NIXL library.
  For more information about the NIXL Benchmark arguments, see the NIXLbench README in the official nixlbench repository.

Get started with EFA and NIXL for inference workloads on Amazon EC2

Requirements

Steps

Important

To create an EFA-enabled security group

Important

To launch a temporary instance

Note

Important

To install the Nvidia GPU drivers, Nvidia CUDA toolkit, and cuDNN

Important

To install GDRCopy

Important

To install the EFA software

Note

Note

To install NIXL using PyPI

To build and install NIXL from source

To install and test NIXL Benchmark using Docker

Note

Important

To install NIXL Benchmark

To test your EFA and NIXL configuration