@@ -54,6 +54,7 @@ all_examples = [
         'vdpa',
         'vhost',
         'vhost_blk',
+        'vhost_user_rdma',
         'vhost_crypto',
         'vm_power_manager',
         'vm_power_manager/guest_cli',

@@ -0,0 +1,607 @@
+/*
+ * Vhost-user RDMA Device - Initialization and Packet Forwarding
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ * Copyright (C) 2025 KylinSoft Inc. All rights reserved.
+ *
+ * Author: Xiong Weimin <xiongweimin@kylinos.cn>
+ *
+ */
+
+#include <signal.h>
+#include <getopt.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdint.h>
+#include <inttypes.h>
+#include <sys/types.h>
+#include <sys/queue.h>
+#include <stdarg.h>
+#include <ctype.h>
+#include <errno.h>
+
+/* DPDK headers */
+#include <rte_memory.h>
+#include <rte_launch.h>
+#include <rte_eal.h>
+#include <rte_per_lcore.h>
+#include <rte_lcore.h>
+#include <rte_debug.h>
+#include <rte_log.h>
+#include <rte_ethdev.h>
+#include <rte_mbuf.h>
+#include <rte_ring.h>
+#include <rte_malloc.h>
+#include <dev_driver.h>
+
+/* Local headers */
+#include "vhost_rdma_ib.h"
+#include "vhost_rdma.h"
+#include "vhost_rdma_pkt.h"
+#include "vhost_rdma_log.h"
+
+/**
+ * Maximum length for Unix socket path
+ */
+#define SOCKET_PATH_MAX		 64
+
+/**
+ * Default number of RX/TX descriptors
+ */
+#define MAX_NB_RXD			  1024
+#define MAX_NB_TXD			  1024
+
+/**
+ * Size of shared rings between vhost devices and datapath
+ */
+#define MAX_RING_COUNT		  1024
+
+/**
+ * Default number of mbufs in memory pool
+ */
+#define NUM_MBUFS_DEFAULT	   (1UL << 16)  // 65536
+
+/**
+ * Cache size for per-lcore mbuf cache
+ */
+#define MBUF_CACHE_SIZE		 256
+
+/**
+ * Data buffer size in each mbuf
+ */
+#define MBUF_DATA_SIZE		  RTE_MBUF_DEFAULT_BUF_SIZE
+
+/* Forward declarations */
+extern struct vhost_rdma_device g_vhost_rdma_dev[];
+
+/* Global configuration */
+static char *socket_path;				/* Array of socket paths */
+static int nb_sockets = 0;					  /* Number of vhost sockets */
+static uint16_t pair_port_id = UINT16_MAX;	  /* Physical port ID to forward packets */
+static volatile bool force_quit;		/* Signal to exit cleanly */
+
+/* Stats and feature flags */
+static uint32_t enable_stats;			   /* Enable periodic stats printing (seconds) */
+static uint32_t enable_tx_csum;			 /* Enable TX checksum offload */
+static int total_num_mbufs = NUM_MBUFS_DEFAULT;/* Total mbufs across pools */
+
+/* Shared resources */
+static struct rte_ring *vhost_rdma_rx_ring;
+static struct rte_ring *vhost_rdma_tx_ring;
+static struct rte_mempool *vhost_rdma_mbuf_pool;
+
+/* Per-lcore info for device management */
+struct lcore_info {
+	uint32_t device_num;
+	TAILQ_HEAD(vhost_dev_tailq_list, vhost_rdma_device) vdev_list;
+};
+
+static struct lcore_info lcore_info[RTE_MAX_LCORE];
+static unsigned int lcore_ids[RTE_MAX_LCORE];
+
+/* Port configuration templates */
+static struct rte_eth_conf default_port_config;
+
+static struct rte_eth_conf offload_port_config = {
+	.txmode = {
+				.offloads = RTE_ETH_TX_OFFLOAD_IPV4_CKSUM |
+							RTE_ETH_TX_OFFLOAD_UDP_CKSUM |
+							RTE_ETH_TX_OFFLOAD_TCP_CKSUM,
+	},
+};
+
+enum {
+#define OPT_STATS			   "stats"
+	OPT_STATS_NUM,
+#define OPT_SOCKET_FILE		 "socket-file"
+	OPT_SOCKET_FILE_NUM,
+#define OPT_TX_CSUM			 "tx-csum"
+	OPT_TX_CSUM_NUM,
+#define OPT_NUM_MBUFS		   "total-num-mbufs"
+	OPT_NUM_MBUFS_NUM,
+};
+
+/**
+ * @brief Unregister all registered vhost drivers.
+ *
+ * Called during signal cleanup to ensure no stale sockets remain.
+ *
+ * @param socket_num Number of socket paths to unregister
+ */
+static void
+unregister_drivers(int socket_num)
+{
+	int i, ret;
+
+	for (i = 0; i < socket_num; i++) {
+		const char *path = socket_path + i * SOCKET_PATH_MAX;
+		ret = rte_vhost_driver_unregister(path);
+		if (ret != 0) {
+			RDMA_LOG_ERR("Failed to unregister vhost driver for socket %s\n", path);
+		} else {
+				RDMA_LOG_INFO("Unregistered socket: %s\n", path);
+		}
+	}
+}
+
+/**
+ * @brief Signal handler for graceful shutdown (SIGINT).
+ *
+ * Cleans up vhost driver registrations and exits.
+ */
+static void
+vhost_rdma_signal_handler(__rte_unused int signum)
+{
+	RDMA_LOG_INFO("Received SIGINT, shutting down...\n");
+
+	if((signum == SIGINT) || (signum == SIGTERM))
+		force_quit = true;
+
+	unregister_drivers(nb_sockets);
+	exit(0);
+}
+
+/**
+ * @brief Initialize an Ethernet port with given offload settings.
+ *
+ * Configures one RX/TX queue, sets up descriptor rings, starts the port.
+ *
+ * @param port_id The port identifier
+ * @param offload Whether to enable hardware offloads
+ * @return 0 on success, negative on failure
+ */
+static int
+vhost_rdma_init_port(uint16_t port_id, bool offload)
+{
+	int ret;
+	uint16_t nb_rxd = MAX_NB_RXD;
+	uint16_t nb_txd = MAX_NB_TXD;
+	struct rte_eth_dev_info dev_info;
+	struct rte_eth_conf port_conf = offload ? offload_port_config : default_port_config;
+	struct rte_eth_txconf txconf;
+	struct rte_ether_addr addr;
+	char mac_str[RTE_ETHER_ADDR_FMT_SIZE];
+
+	RDMA_LOG_INFO("Initializing port %u with %s offloads\n", port_id,
+				offload ? "enabled" : "disabled");
+
+	ret = rte_eth_dev_info_get(port_id, &dev_info);
+	if (ret < 0) {
+		RDMA_LOG_ERR("Failed to get device info for port %u\n", port_id);
+		goto out;
+	}
+
+	ret = rte_eth_dev_configure(port_id, 1, 1, &port_conf);
+	if (ret < 0) {
+		RDMA_LOG_ERR("Failed to configure port %u\n", port_id);
+		goto out;
+	}
+
+	ret = rte_eth_dev_adjust_nb_rx_tx_desc(port_id, &nb_rxd, &nb_txd);
+	if (ret < 0) {
+		LOG_WARN("Failed to adjust number of descriptors for port %u\n", port_id);
+	}
+
+	ret = rte_eth_rx_queue_setup(port_id, 0, nb_rxd,
+						rte_eth_dev_socket_id(port_id),
+						NULL,
+						vhost_rdma_mbuf_pool);
+	if (ret < 0) {
+		RDMA_LOG_ERR("Failed to setup RX queue for port %u\n", port_id);
+		goto out;
+	}
+
+	txconf = dev_info.default_txconf;
+	txconf.offloads = port_conf.txmode.offloads;
+	ret = rte_eth_tx_queue_setup(port_id, 0, nb_txd,
+							rte_eth_dev_socket_id(port_id),
+							&txconf);
+	if (ret < 0) {
+		RDMA_LOG_ERR("Failed to setup TX queue for port %u\n", port_id);
+		goto out;
+	}
+
+	ret = rte_eth_dev_start(port_id);
+	if (ret < 0) {
+		RDMA_LOG_ERR("Failed to start port %u\n", port_id);
+		goto out;
+	}
+
+	ret = rte_eth_promiscuous_enable(port_id);
+	if (ret < 0) {
+		LOG_WARN("Failed to enable promiscuous mode on port %u\n", port_id);
+	}
+
+	ret = rte_eth_macaddr_get(port_id, &addr);
+	if (ret == 0) {
+		rte_ether_format_addr(mac_str, sizeof(mac_str), &addr);
+		RDMA_LOG_INFO("Port %u MAC address: %s\n", port_id, mac_str);
+	} else {
+		LOG_WARN("Could not read MAC address for port %u\n", port_id);
+	}
+
+out:
+	return ret;
+}
+
+/**
+ * @brief Print usage information.
+ */
+static void
+vhost_rdma_usage(const char *prgname)
+{
+	printf("%s [EAL options] --\n"
+		"	-p PORTMASK\n"
+		"	--socket-file <path>		: Path to vhost-user socket (can be repeated)\n"
+		"	--stats <N>					: Print stats every N seconds (0=disable)\n"
+		"	--tx-csum <0|1>				: Disable/enable TX checksum offload\n"
+		"	--total-num-mbufs <N>		: Total number of mbufs in pool (default: %ld)\n",
+		prgname, NUM_MBUFS_DEFAULT);
+}
+
+/**
+ * @brief Parse a numeric option safely.
+ *
+ * @param q_arg Input string
+ * @param max_valid_value Maximum allowed value
+ * @return Parsed integer or -1 on error
+ */
+static int
+vhost_rdma_parse_num_opt(const char *q_arg, uint32_t max_valid_value)
+{
+	char *end = NULL;
+	unsigned long num;
+
+	errno = 0;
+	num = strtoul(q_arg, &end, 10);
+
+	if (!q_arg || q_arg[0] == '\0' || end == NULL || *end != '\0')
+		return -1;
+	if (errno != 0 || num > max_valid_value)
+		return -1;
+
+	return (int)num;
+}
+
+/**
+ * @brief Parse and store vhost socket path.
+ *
+ * Supports multiple sockets via repeated --socket-file.
+ *
+ * @param q_arg Socket file path
+ * @return 0 on success, -1 on failure
+ */
+static int
+vhost_rdma_parse_socket_path(const char *q_arg)
+{
+	char *old_ptr;
+
+	if (strnlen(q_arg, SOCKET_PATH_MAX) >= SOCKET_PATH_MAX) {
+		RTE_LOG(ERR, VHOST_CONFIG, "Socket path too long: %s\n", q_arg);
+		return -1;
+	}
+
+	old_ptr = socket_path;
+	socket_path = realloc(socket_path, SOCKET_PATH_MAX * (nb_sockets + 1));
+	if (socket_path == NULL) {
+		free(old_ptr);
+		return -1;
+	}
+
+	strncpy(socket_path + nb_sockets * SOCKET_PATH_MAX, q_arg, SOCKET_PATH_MAX - 1);
+	socket_path[(nb_sockets + 1) * SOCKET_PATH_MAX - 1] = '\0';
+
+	RDMA_LOG_INFO("Registered socket[%d]: %s\n",
+				nb_sockets, socket_path + nb_sockets * SOCKET_PATH_MAX);
+
+	nb_sockets++;
+	return 0;
+}
+
+/**
+ * @brief Parse command-line arguments.
+ *
+ * Supported options:
+ *   --socket-file, --stats, --tx-csum, --total-num-mbufs
+ *
+ * @param argc Argument count
+ * @param argv Argument vector
+ * @return 0 on success, -1 on failure
+ */
+static int
+vhost_rdma_parse_args(int argc, char **argv)
+{
+	int opt, ret;
+	int option_idx;
+	const char *prgname = argv[0];
+
+	static struct option lgopts[] = {
+		{ "stats",			required_argument, NULL, OPT_STATS_NUM },
+		{ "socket-file",	required_argument, NULL, OPT_SOCKET_FILE_NUM },
+		{ "tx-csum",		required_argument, NULL, OPT_TX_CSUM_NUM },
+		{ "total-num-mbufs",required_argument, NULL, OPT_NUM_MBUFS_NUM },
+		{ NULL, 0, NULL, 0 }
+	};
+
+	while ((opt = getopt_long(argc, argv, "",
+							  lgopts, &option_idx)) != EOF) {
+		switch (opt) {
+		case OPT_STATS_NUM:
+			ret = vhost_rdma_parse_num_opt(optarg, INT32_MAX);
+			if (ret < 0) {
+				RTE_LOG(ERR, VHOST_CONFIG, "Invalid value for --stats\n");
+				vhost_rdma_usage(prgname);
+				return -1;
+			}
+			enable_stats = ret;
+			break;
+
+		case OPT_NUM_MBUFS_NUM:
+			ret = vhost_rdma_parse_num_opt(optarg, INT32_MAX);
+			if (ret < 0 || ret == 0) {
+				RTE_LOG(ERR, VHOST_CONFIG, "Invalid value for --total-num-mbufs\n");
+				vhost_rdma_usage(prgname);
+				return -1;
+			}
+			total_num_mbufs = ret;
+			break;
+
+		case OPT_SOCKET_FILE_NUM:
+			if (vhost_rdma_parse_socket_path(optarg) < 0) {
+				RTE_LOG(ERR, VHOST_CONFIG, "Invalid socket path: %s\n", optarg);
+				vhost_rdma_usage(prgname);
+				return -1;
+			}
+			break;
+
+		case OPT_TX_CSUM_NUM:
+			ret = vhost_rdma_parse_num_opt(optarg, 1);
+			if (ret < 0) {
+				RTE_LOG(ERR, VHOST_CONFIG, "Invalid value for --tx-csum (must be 0 or 1)\n");
+				vhost_rdma_usage(prgname);
+				return -1;
+			}
+			enable_tx_csum = ret;
+			break;
+
+		default:
+			vhost_rdma_usage(prgname);
+			return -1;
+		}
+	}
+
+	if (nb_sockets == 0) {
+		RTE_LOG(ERR, VHOST_CONFIG, "At least one --socket-file must be specified.\n");
+		vhost_rdma_usage(prgname);
+		return -1;
+	}
+
+	return 0;
+}
+
+static int
+vhost_rdma_main_loop(__rte_unused void* arg) 
+{
+	while (!force_quit) {
+
+	}
+	return 0;
+}
+
+/**
+ * @brief Application entry point.
+ *
+ * Initializes EAL, parses args, sets up ports, mempools, rings,
+ * registers vhost drivers, launches threads.
+ */
+int main(int argc, char **argv)
+{
+	unsigned lcore_id, core_id = 0;
+	int ret;
+	uint16_t port_id;
+	bool pair_found = false;
+	struct rte_eth_dev_info dev_info;
+
+	force_quit = false;
+	enable_stats = 0;
+	enable_tx_csum = 0;
+
+	/* Register signal handler for clean shutdown */
+	signal(SIGINT, vhost_rdma_signal_handler);
+	signal(SIGTERM, vhost_rdma_signal_handler);
+
+	/* Initialize DPDK Environment Abstraction Layer */
+	ret = rte_eal_init(argc, argv);
+	if (ret < 0)
+		rte_panic("Unable to initialize DPDK EAL\n");
+
+	argc -= ret;
+	argv += ret;
+
+	rte_log_set_global_level(RTE_LOG_NOTICE);
+
+	/* Parse application-specific arguments */
+	if (vhost_rdma_parse_args(argc, argv) != 0) {
+		rte_exit(EXIT_FAILURE, "Argument parsing failed\n");
+	}
+
+	/* Initialize per-lcore data structures */
+	for (lcore_id = 0; lcore_id < RTE_MAX_LCORE; lcore_id++) {
+		TAILQ_INIT(&lcore_info[lcore_id].vdev_list);
+		if (rte_lcore_is_enabled(lcore_id)) {
+			lcore_ids[core_id++] = lcore_id;
+		}
+	}
+
+	if (rte_lcore_count() < 2) {
+		rte_exit(EXIT_FAILURE, "At least two cores required (one main + one worker)\n");
+	}
+
+	/*
+	 * Create shared memory pool for mbufs
+	 * Used by both RX and TX paths
+	 */
+	vhost_rdma_mbuf_pool = rte_pktmbuf_pool_create(
+							"mbuf_pool_shared",
+							total_num_mbufs,
+							MBUF_CACHE_SIZE,
+							sizeof(struct vhost_rdma_pkt_info),
+							MBUF_DATA_SIZE,
+							rte_socket_id());
+
+	if (vhost_rdma_mbuf_pool == NULL) {
+		rte_exit(EXIT_FAILURE, "Cannot create mbuf pool: %s\n", rte_strerror(rte_errno));
+	}
+
+	/*
+	 * Create shared rings for packet exchange
+	 * SP_ENQ: Single-producer enqueue (from NIC)
+	 * MC_HTS_DEQ: Multi-consumer with HTS dequeue (to workers)
+	 */
+	vhost_rdma_rx_ring = rte_ring_create(
+		"ring_rx_shared",
+		MAX_RING_COUNT,
+		rte_socket_id(),
+		RING_F_SP_ENQ | RING_F_MC_HTS_DEQ
+	);
+	if (vhost_rdma_rx_ring == NULL)
+		rte_exit(EXIT_FAILURE, "Failed to create RX ring: %s\n", rte_strerror(rte_errno));
+
+	vhost_rdma_tx_ring = rte_ring_create(
+		"ring_tx_shared",
+		MAX_RING_COUNT,
+		rte_socket_id(),
+		RING_F_MP_HTS_ENQ | RING_F_SC_DEQ
+	);
+	if (vhost_rdma_tx_ring == NULL)
+		rte_exit(EXIT_FAILURE, "Failed to create TX ring: %s\n", rte_strerror(rte_errno));
+
+	/*
+	 * Find and initialize backend Ethernet device (e.g., net_tap or net_vhost)
+	 */
+	RTE_ETH_FOREACH_DEV(port_id) {
+		ret = rte_eth_dev_info_get(port_id, &dev_info);
+		if (ret != 0) {
+			RDMA_LOG_ERR("Failed to get info for port %u\n", port_id);
+			continue;
+		}
+
+		if (!pair_found &&
+			(strcmp(dev_info.driver_name, "net_tap") == 0 ||
+			 strcmp(dev_info.driver_name, "net_vhost") == 0)) {
+
+			pair_port_id = port_id;
+			pair_found = true;
+
+			ret = vhost_rdma_init_port(port_id, !!enable_tx_csum);
+			if (ret != 0) {
+				rte_exit(EXIT_FAILURE, "Failed to initialize port %u: %s\n",
+						port_id, rte_strerror(-ret));
+			}
+
+			RDMA_LOG_INFO("Using device %s (port %u) as backend interface\n",
+						dev_info.device->name, port_id);
+		}
+	}
+
+	if (!pair_found) {
+		rte_exit(EXIT_FAILURE, "No suitable backend Ethernet device found\n");
+	}
+
+	/*
+	 * Setup per-vhost-device resources and register vhost drivers
+	 */
+	char name_buf[SOCKET_PATH_MAX];
+	for (int i = 0; i < nb_sockets; i++) {
+		const char *sock_path = socket_path + i * SOCKET_PATH_MAX;
+		struct vhost_rdma_device *dev = &g_vhost_rdma_dev[i];
+
+		dev->vid = i;
+
+		if (i == 0) {
+			/* Use shared resources for first device */
+			dev->rx_ring = vhost_rdma_rx_ring;
+			dev->tx_ring = vhost_rdma_tx_ring;
+			dev->mbuf_pool = vhost_rdma_mbuf_pool;
+		} else {
+			/* Create dedicated resources for additional devices */
+			snprintf(name_buf, sizeof(name_buf), "dev%u_rx_ring", i);
+			dev->rx_ring = rte_ring_create(name_buf, MAX_RING_COUNT,
+										rte_socket_id(), RING_F_SP_ENQ | RING_F_MC_HTS_DEQ);
+			if (!dev->rx_ring)
+				rte_exit(EXIT_FAILURE, "Failed to create RX ring %d\n", i);
+
+			snprintf(name_buf, sizeof(name_buf), "dev%u_tx_ring", i);
+			dev->tx_ring = rte_ring_create(name_buf, MAX_RING_COUNT,
+										rte_socket_id(), RING_F_MP_HTS_ENQ | RING_F_SC_DEQ);
+			if (!dev->tx_ring)
+				rte_exit(EXIT_FAILURE, "Failed to create TX ring %d\n", i);
+
+			snprintf(name_buf, sizeof(name_buf), "dev%u_mbuf_pool", i);
+			dev->mbuf_pool = rte_pktmbuf_pool_create(name_buf,
+												total_num_mbufs,
+												MBUF_CACHE_SIZE,
+												sizeof(struct vhost_rdma_pkt_info),
+												MBUF_DATA_SIZE,
+												rte_socket_id());
+			if (!dev->mbuf_pool)
+				rte_exit(EXIT_FAILURE, "Failed to create mbuf pool %d\n", i);
+		}
+
+		snprintf(name_buf, sizeof(name_buf), "dev%u_task_ring", i);
+		dev->task_ring = rte_ring_create(name_buf, MAX_RING_COUNT,
+										rte_socket_id(),
+										RING_F_MP_HTS_ENQ | RING_F_MC_HTS_DEQ);
+		if (!dev->task_ring)
+			rte_exit(EXIT_FAILURE, "Failed to create task ring %d\n", i);		
+
+		/* Construct and register vhost device */
+		ret = vhost_rdma_construct(dev, sock_path, i);
+		if (ret < 0) {
+			RDMA_LOG_ERR("Failed to construct vhost device %d\n", i);
+			continue;
+		}
+
+		ret = rte_vhost_driver_start(sock_path);
+		if (ret < 0) {
+			RDMA_LOG_ERR("Failed to start vhost driver for %s\n", sock_path);
+		} else {
+			RDMA_LOG_INFO("Successfully started vhost driver: %s\n", sock_path);
+		}
+	}
+
+	/* Wait for all worker threads to complete (they won't unless forced) */
+	RTE_LCORE_FOREACH_WORKER(lcore_id) {
+		rte_eal_wait_lcore(lcore_id);
+	}
+
+	vhost_rdma_main_loop(NULL);
+
+	/* Cleanup */
+	rte_eal_cleanup();
+	free(socket_path);
+
+	RDMA_LOG_INFO("Application terminated gracefully.\n");
+	return 0;
+}

@@ -0,0 +1,45 @@
+# SPDX-License-Identifier: BSD-3-Clause
+# Copyright(c) 2017 Intel Corporation
+
+# meson file, for building this example as part of a main DPDK build.
+#
+# To build this example as a standalone application with an already-installed
+# DPDK instance, use 'make'
+
+if not is_linux
+    build = false
+    subdir_done()
+endif
+
+deps += ['vhost', 'timer']
+
+allow_experimental_apis = true
+
+cflags_options = [
+        '-std=c11',
+        '-Wno-strict-prototypes',
+        '-Wno-pointer-arith',
+        '-Wno-maybe-uninitialized',
+        '-Wno-discarded-qualifiers',
+        '-Wno-old-style-definition',
+        '-Wno-sign-compare',
+        '-Wno-stringop-overflow',
+        '-O3',
+        '-g',
+        '-DALLOW_EXPERIMENTAL_API',
+        '-DDEBUG_RDMA',
+        '-DDEBUG_RDMA_DP',
+]
+
+foreach option:cflags_options
+    if cc.has_argument(option)
+        cflags += option
+    endif
+endforeach
+
+sources = files(
+    'main.c',
+    'vhost_rdma.c',
+    'vhost_rdma_ib.c',
+)
+

@@ -0,0 +1,697 @@
+/*
+ * Vhost-user RDMA device : init and packets forwarding
+ *
+ * Copyright (C) 2025 KylinSoft Inc. and/or its affiliates. All rights reserved.
+ *
+ * Author: Xiong Weimin <xiongweimin@kylinos.cn>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include <unistd.h>
+#include <stdlib.h>
+
+#include <rte_malloc.h>
+#include <rte_bitmap.h>
+#include <rte_common.h>
+#include <rte_ring.h>
+#include <rte_vhost.h>
+#include <rte_malloc.h>
+
+#include "vhost_rdma.h"
+#include "vhost_rdma_ib.h"
+#include "vhost_rdma_pkt.h"
+#include "vhost_rdma_log.h"
+
+#define VHOST_MAX_DEVICES 32
+
+struct vhost_rdma_device g_vhost_rdma_dev[MAX_VHOST_RDMA_DEV_NUM];
+struct vhost_rdma_net_dev g_vhost_rdma_net_dev[MAX_VHOST_RDMA_DEV_NUM];
+
+/**
+ * @brief Install required vhost-user protocol features for RDMA device.
+ *
+ * Enables CONFIG and MQ features which are essential for multi-queue
+ * and configuration space access in vhost-user frontend.
+ *
+ * @param path Socket or VFIO device path used by vhost driver
+ */
+static void
+vhost_rdma_install_rte_compat_hooks(const char *path)
+{
+	uint64_t protocol_features = 0;
+
+	if (!path) {
+		RDMA_LOG_ERR("Invalid path parameter");
+		return;
+	}
+
+	/* Retrieve current protocol features */
+	if (rte_vhost_driver_get_protocol_features(path, &protocol_features) < 0) {
+		RDMA_LOG_DEBUG("Failed to get protocol features for %s, assuming 0", path);
+		protocol_features = 0;
+	}
+
+	/* Enable mandatory features */
+	protocol_features |= (1ULL << VHOST_USER_PROTOCOL_F_CONFIG);  // For GET/SET_CONFIG
+	protocol_features |= (1ULL << VHOST_USER_PROTOCOL_F_MQ);	  // Multi-queue support
+
+	if (rte_vhost_driver_set_protocol_features(path, protocol_features) < 0) {
+		RDMA_LOG_ERR("Failed to set protocol features on %s", path);
+	} else {
+		RDMA_LOG_DEBUG("Enabled CONFIG and MQ features for %s", path);
+	}
+}
+
+/**
+ * @brief Construct a net device with given queues.
+ *
+ * Initializes the per-device queue mapping and state.
+ *
+ * @param queues Array of vhost-user queues
+ * @param idx	Device index
+ */
+void
+vhost_rdma_net_construct(struct vhost_user_queue *queues, int idx)
+{
+	if (idx < 0 || idx >= VHOST_MAX_DEVICES) {
+		RDMA_LOG_ERR("Invalid device index: %d", idx);
+		return;
+	}
+
+	if (!queues) {
+		RDMA_LOG_ERR("NULL queues pointer for device %d", idx);
+		return;
+	}
+
+	g_vhost_rdma_net_dev[idx].queues = queues;
+	g_vhost_rdma_net_dev[idx].started = false;
+
+	RDMA_LOG_DEBUG("Net device %d constructed with queues=%p", idx, queues);
+}
+
+/**
+ * @brief Initialize an object pool with bitmap-based allocation tracking.
+ *
+ * Allocates contiguous memory for `num` objects and a bitmap to track usage.
+ * Optionally reserves index 0 (when !start_zero), useful for representing invalid handles.
+ *
+ * @param pool	   [out] Pool structure to initialize
+ * @param name	   Name used in memory allocation (can be NULL)
+ * @param num		Number of objects to allocate
+ * @param size	   Size of each object
+ * @param start_zero If true, index 0 is usable; else reserved
+ * @param cleanup	Optional callback called on free (can be NULL)
+ *
+ * @return 0 on success, -1 on failure
+ */
+int
+vhost_rdma_pool_init(struct vhost_rdma_pool *pool,
+					const char *name,
+					uint32_t num,
+					uint32_t size,
+					bool start_zero,
+					void (*cleanup)(void *))
+{
+	void *mem = NULL;
+	uint32_t actual_num;
+	struct rte_bitmap *bmp = NULL;
+	const char *pool_name = name ? name : "vhost_rdma_pool";
+
+	if (!pool || num == 0 || size == 0) {
+		RDMA_LOG_ERR("Invalid parameters: pool=%p, num=%u, size=%u", pool, num, size);
+		return -1;
+	}
+
+	/* Adjust total number: reserve index 0 if needed */
+	actual_num = start_zero ? num : num + 1;
+
+	/* Allocate object storage */
+	pool->objs = rte_zmalloc(pool_name, actual_num * size, RTE_CACHE_LINE_SIZE);
+	if (!pool->objs) {
+		RDMA_LOG_ERR("Failed to allocate %u * %u bytes for objects", actual_num, size);
+		goto err_objs;
+	}
+
+	/* Allocate bitmap metadata */
+	uint32_t bmp_size = rte_bitmap_get_memory_footprint(actual_num);
+	mem = rte_zmalloc(pool_name, bmp_size, RTE_CACHE_LINE_SIZE);
+	if (!mem) {
+		RDMA_LOG_ERR("Failed to allocate %u bytes for bitmap", bmp_size);
+		goto err_bmp_mem;
+	}
+
+	/* Initialize bitmap */
+	bmp = rte_bitmap_init(actual_num, mem, bmp_size);
+	if (!bmp) {
+		RDMA_LOG_ERR("Failed to init bitmap with %u bits", actual_num);
+		goto err_bmp_init;
+	}
+
+	/* Mark all slots as FREE (bitmap: SET = free) */
+	for (uint32_t i = 0; i < actual_num; i++) {
+		rte_bitmap_set(bmp, i);
+	}
+
+	/* Reserve index 0 if not starting from zero */
+	if (!start_zero) {
+		rte_bitmap_clear(bmp, 0);  /* Now allocated/reserved */
+	}
+
+	/* Finalize pool setup */
+	pool->bitmap = bmp;
+	pool->bitmap_mem = mem;
+	pool->num = actual_num;
+	pool->size = size;
+	pool->cleanup = cleanup;
+
+	RDMA_LOG_DEBUG("Pool '%s' initialized: %u entries, obj_size=%u, start_zero=%d",
+				pool_name, actual_num, size, start_zero);
+
+	return 0;
+
+err_bmp_init:
+	rte_free(mem);
+err_bmp_mem:
+	rte_free(pool->objs);
+err_objs:
+	return -1;
+}
+
+/**
+ * @brief Get pointer to object at given index if it is currently allocated.
+ *
+ * Does NOT check thread safety.
+ *
+ * @param pool Pool instance
+ * @param idx  Object index
+ * @return Pointer to object if allocated, NULL otherwise or if out-of-bounds
+ */
+void *
+vhost_rdma_pool_get(struct vhost_rdma_pool *pool, uint32_t idx)
+{
+	if (!pool || idx >= pool->num) {
+		RDMA_LOG_DEBUG("Invalid pool or index: pool=%p, idx=%u, num=%u",
+					pool, idx, pool ? pool->num : 0);
+		return NULL;
+	}
+
+	/* Bitmap: SET = free, CLEAR = allocated */
+	if (rte_bitmap_get(pool->bitmap, idx)) {
+		RDMA_LOG_DEBUG("Object at index %u is free, cannot get", idx);
+		return NULL;
+	}
+
+	return RTE_PTR_ADD(pool->objs, idx * pool->size);
+}
+
+/**
+ * @brief Allocate a new object from the pool.
+ *
+ * Finds the first available slot, clears its bit (marks as used), optionally zeroes memory,
+ * and returns a pointer. Also outputs the assigned index via `idx` parameter.
+ *
+ * @param pool Pool to allocate from
+ * @param idx  [out] Assigned index (optional, pass NULL if not needed)
+ * @return Pointer to allocated object, or NULL if no space
+ */
+void *
+vhost_rdma_pool_alloc(struct vhost_rdma_pool *pool, uint32_t *idx)
+{
+	uint32_t pos = 0;
+	uint64_t slab = 0;
+	void *obj;
+
+	if (!pool) {
+		RDMA_LOG_ERR("NULL pool");
+		return NULL;
+	}
+
+	__rte_bitmap_scan_init(pool->bitmap);
+	int found = rte_bitmap_scan(pool->bitmap, &pos, &slab);
+	if (!found) {
+		RDMA_LOG_DEBUG("No free objects in pool");
+		return NULL;
+	}
+
+	uint32_t allocated_idx = pos + __builtin_ctzll(slab);
+	obj = RTE_PTR_ADD(pool->objs, allocated_idx * pool->size);
+
+	/* Zero-initialize new object */
+	memset(obj, 0, pool->size);
+
+	/* Mark as allocated */
+	rte_bitmap_clear(pool->bitmap, allocated_idx);
+
+	if (idx) {
+		*idx = allocated_idx;
+	}
+
+	RDMA_LOG_DEBUG("Allocated object at index %u", allocated_idx);
+	return obj;
+}
+
+/**
+ * @brief Free an object back into the pool.
+ *
+ * Calls optional cleanup callback before releasing.
+ * Not thread-safe — must be externally synchronized.
+ *
+ * @param pool Pool containing the object
+ * @param idx  Index of object to free
+ */
+void
+vhost_rdma_pool_free(struct vhost_rdma_pool *pool, uint32_t idx)
+{
+	if (!pool || idx >= pool->num) {
+		RDMA_LOG_ERR("Invalid pool or index: pool=%p, idx=%u", pool, idx);
+		return;
+	}
+
+	void *obj = vhost_rdma_pool_get(pool, idx);
+	if (!obj) {
+		RDMA_LOG_DEBUG("Index %u already free, skipping", idx);
+		return;  /* Idempotent: already free */
+	}
+
+	/* Call user-defined cleanup hook */
+	if (pool->cleanup) {
+		pool->cleanup(obj);
+	}
+
+	/* Return to free list */
+	rte_bitmap_set(pool->bitmap, idx);
+
+	RDMA_LOG_DEBUG("Freed object at index %u", idx);
+}
+
+/**
+ * @brief Destroy the entire pool and release all memory.
+ *
+ * WARNING: Caller must ensure no live references exist.
+ * Does NOT call cleanup() on remaining live objects.
+ *
+ * @param pool Pool to destroy
+ */
+void
+vhost_rdma_pool_destroy(struct vhost_rdma_pool *pool)
+{
+	if (!pool) {
+		return;
+	}
+
+	if (pool->bitmap_mem) {
+		rte_bitmap_free(pool->bitmap);  /* Frees internal state too */
+		rte_free(pool->bitmap_mem);
+		pool->bitmap = NULL;
+		pool->bitmap_mem = NULL;
+	}
+
+	if (pool->objs) {
+		rte_free(pool->objs);
+		pool->objs = NULL;
+	}
+
+	pool->num = 0;
+	pool->size = 0;
+	pool->cleanup = NULL;
+
+	RDMA_LOG_DEBUG("Pool destroyed");
+}
+
+/**
+ * @brief Set up the vhost-user network backend for a given device.
+ *
+ * Initializes guest memory mapping, negotiates features (e.g., merged RX buffers),
+ * sets header length accordingly, disables unnecessary notifications during setup,
+ * and marks the device as started.
+ *
+ * @param vid Vhost device ID (from rte_vhost driver)
+ */
+void
+vs_vhost_rdma_net_setup(int vid)
+{
+	struct vhost_rdma_net_dev *dev;
+	uint64_t negotiated_features = 0;
+	int ret;
+
+	/* Validate input */
+	if (vid < 0 || vid >= VHOST_MAX_DEVICES) {
+		RDMA_LOG_ERR("Invalid vhost device ID: %d", vid);
+		return;
+	}
+
+	dev = &g_vhost_rdma_net_dev[vid];
+	if (!dev) {
+		RDMA_LOG_ERR("Device structure not initialized for vid=%d", vid);
+		return;  /* Should never happen */
+	}
+
+	/* Initialize device context */
+	dev->vid = vid;
+	dev->started = false;
+
+	/* Step 1: Get negotiated VirtIO features */
+	if (rte_vhost_get_negotiated_features(vid, &negotiated_features) < 0) {
+		RDMA_LOG_ERR("Failed to get negotiated features for vid=%d", vid);
+		return;
+	}
+	dev->features = negotiated_features;
+
+	/* Step 2: Determine virtio-net header size based on features */
+	if (negotiated_features & ((1ULL << VIRTIO_NET_F_MRG_RXBUF) |
+							(1ULL << VIRTIO_F_VERSION_1))) {
+		dev->hdr_len = sizeof(struct virtio_net_hdr_mrg_rxbuf);
+		RDMA_LOG_DEBUG("Using merged RX buffer header (size=%zu) for vid=%d",
+					dev->hdr_len, vid);
+	} else {
+		dev->hdr_len = sizeof(struct virtio_net_hdr);
+		RDMA_LOG_DEBUG("Using standard net header (size=%zu) for vid=%d",
+					dev->hdr_len, vid);
+	}
+
+	/* Step 3: Get guest memory table (VA->GPA/HPA translation) */
+	if (dev->mem) {
+		rte_free(dev->mem);
+		dev->mem = NULL;
+	}
+
+	ret = rte_vhost_get_mem_table(vid, &dev->mem);
+	if (ret < 0 || dev->mem == NULL) {
+		RDMA_LOG_ERR("Failed to retrieve guest memory layout for vid=%d", vid);
+		return;
+	}
+
+	RDMA_LOG_INFO("Guest memory table acquired: %u regions mapped", dev->mem->nregions);
+
+	/* Step 4: Disable guest notification during initial setup */
+	ret = rte_vhost_enable_guest_notification(vid, VHOST_NET_RXQ, 0);
+	if (ret < 0) {
+		RDMA_LOG_ERR("Failed to disable RX queue kick suppression for vid=%d", vid);
+	}
+
+	ret = rte_vhost_enable_guest_notification(vid, VHOST_NET_TXQ, 0);
+	if (ret < 0) {
+		RDMA_LOG_ERR("Failed to disable TX queue kick suppression for vid=%d", vid);
+	}
+
+	/* Final step: Mark device as ready */
+	dev->started = true;
+
+	RDMA_LOG_INFO("vhost-user net device vid=%d setup completed successfully", vid);
+}
+
+/**
+ * @brief Callback: A new vhost-user device has been negotiated and is ready for setup.
+ *
+ * This function initializes the backend RDMA device context, sets up networking parameters,
+ * allocates required resources, and marks the device as started.
+ *
+ * @param vid Vhost device identifier assigned by rte_vhost
+ * @return 0 on success, negative on failure (though return value is often ignored)
+ */
+static int
+vhost_rdma_new_device(int vid)
+{
+	struct vhost_rdma_device *dev;
+
+	/* Validate device ID */
+	if (vid < 0 || vid >= VHOST_MAX_DEVICES) {
+		RDMA_LOG_ERR("Invalid vhost device ID: %d", vid);
+		return -1;
+	}
+
+	dev = &g_vhost_rdma_dev[vid];
+
+	/* Avoid re-initializing an already started device */
+	if (dev->started) {
+		RDMA_LOG_DEBUG("Device vid=%d already started, skipping initialization", vid);
+		return 0;
+	}
+
+	/* Setup network layer: features, header size, memory table */
+	vs_vhost_rdma_net_setup(vid);
+
+	/* Finalize device state */
+	dev->vid = vid;
+	dev->started = true;
+	dev->stopped = false;
+
+	RDMA_LOG_INFO("New vhost-RDMA device created: vid=%d", vid);
+	return 0;
+}
+
+/**
+ * @brief Clean up guest memory mapping for a vhost device.
+ *
+ * Frees memory allocated by rte_vhost_get_mem_table().
+ * Safe to call multiple times (idempotent).
+ *
+ * @param vid Device ID
+ */
+static void
+vs_vhost_rdma_net_remove(int vid)
+{
+	struct vhost_rdma_net_dev *net_dev;
+
+	if (vid < 0 || vid >= VHOST_MAX_DEVICES) {
+		RDMA_LOG_ERR("Invalid device ID in net_remove: %d", vid);
+		return;
+	}
+
+	net_dev = &g_vhost_rdma_net_dev[vid];
+
+	if (net_dev->mem) {
+		RDMA_LOG_DEBUG("Freeing guest memory table for vid=%d", vid);
+		rte_free(net_dev->mem);	/* Use rte_free() because allocated via DPDK */
+		net_dev->mem = NULL;
+	} else {
+		RDMA_LOG_DEBUG("No memory table to free for vid=%d", vid);
+	}
+}
+
+/**
+ * @brief Destroy and release all resources associated with a vhost-RDMA device.
+ *
+ * Called when frontend disconnects or device is removed.
+ * Ensures safe teardown of IB context, queues, memory mappings, and notification states.
+ *
+ * @param vid Vhost device ID
+ */
+static void
+vhost_rdma_destroy_device(__rte_unused int vid)
+{
+	struct vhost_rdma_device *dev;
+	struct vhost_user_queue *vq;
+	unsigned int lcore_id;
+
+	if (vid < 0 || vid >= VHOST_MAX_DEVICES) {
+		RDMA_LOG_ERR("Attempted to destroy invalid device ID: %d", vid);
+		return;
+	}
+
+	dev = &g_vhost_rdma_dev[vid];
+
+	if (!dev->started) {
+		RDMA_LOG_DEBUG("Device vid=%d not started, nothing to destroy", vid);
+		return;
+	}
+
+	/* Mark device as stopping */
+	dev->started = false;
+	dev->stopped = true;
+
+	RDMA_LOG_INFO("Destroying vhost-RDMA device: vid=%d", vid);
+
+	/*
+	 * Wait gracefully until device is no longer in use.
+	 * Use atomic counter if available, or yield CPU.
+	 *
+	 * Note: Original code had `while (dev->inuse == 0)` which waits forever if never used!
+	 * Should be: while (dev->inuse > 0)
+	 */
+	while (dev->inuse > 0) {
+		lcore_id = rte_lcore_id();
+		if (lcore_id != RTE_MAX_LCORE) {
+			rte_pause();	/* Yield CPU time on polling lcore */
+		} else {
+			rte_delay_us_block(100);  /* Background thread sleep */
+		}
+	}
+
+	/* Step 1: Remove from network subsystem */
+	vs_vhost_rdma_net_remove(vid);
+
+	/* Step 2: Destroy InfiniBand/RDMA components (QP, CQ, MR cleanup) */
+	vhost_rdma_destroy_ib(dev);
+
+	/* Step 3: Persist vring indices before shutdown */
+	for (int i = 0; i < NUM_VHOST_QUEUES; i++) {
+		vq = &dev->vqs[i];
+
+		if (vq->enabled) {
+			int ret = rte_vhost_set_vring_base(dev->vid, i,
+											vq->last_avail_idx,
+											vq->last_used_idx);
+			if (ret < 0) {
+				RDMA_LOG_ERR("Failed to save vring base for queue %d", i);
+			}
+
+			vq->enabled = false;
+			RDMA_LOG_DEBUG("Disabled vring %d", i);
+		}
+	}
+
+	/* Step 4: Free per-device memory table (if any) */
+	if (dev->mem) {
+		RDMA_LOG_DEBUG("Freeing device memory table for vid=%d", vid);
+		rte_free(dev->mem);
+		dev->mem = NULL;
+	}
+
+	RDMA_LOG_INFO("vhost-RDMA device destroyed successfully: vid=%d", vid);
+}
+
+static enum rte_vhost_msg_result extern_vhost_pre_msg_handler(__rte_unused int vid, void *_msg)
+{
+	struct vhost_rdma_device *dev;
+	struct vhost_user_rdma_msg *msg = _msg;
+
+	dev = &g_vhost_rdma_dev[vid];
+
+	switch ((int)msg->request) {
+	case VHOST_USER_GET_VRING_BASE:
+	case VHOST_USER_SET_VRING_BASE:
+	case VHOST_USER_SET_VRING_ADDR:
+	case VHOST_USER_SET_VRING_NUM:
+	case VHOST_USER_SET_VRING_KICK:
+	case VHOST_USER_SET_VRING_CALL:
+	case VHOST_USER_SET_MEM_TABLE:
+		break;
+	case VHOST_USER_GET_CONFIG: {
+		rte_memcpy(msg->payload.cfg.region, &dev->rdma_config, sizeof(dev->rdma_config));
+		return RTE_VHOST_MSG_RESULT_REPLY;
+	}
+	case VHOST_USER_SET_CONFIG:
+	default:
+		break;
+	}
+
+	return RTE_VHOST_MSG_RESULT_NOT_HANDLED;
+}
+
+struct rte_vhost_user_extern_ops g_extern_vhost_ops = {
+	.pre_msg_handle = extern_vhost_pre_msg_handler,
+};
+
+static int vhost_rdma_new_connection(int vid)
+{
+	int ret = 0;
+
+	ret = rte_vhost_extern_callback_register(vid, &g_extern_vhost_ops, NULL);
+	if (ret != 0)
+		RDMA_LOG_ERR(
+			"rte_vhost_extern_callback_register failed for vid = %d\n",
+			vid);
+
+	g_vhost_rdma_dev[vid].vid = vid;
+	return ret;
+}
+
+static int vhost_rdma_vring_state_changed(int vid, uint16_t queue_id, int enable)
+{
+	struct vhost_rdma_device *dev = &g_vhost_rdma_dev[vid];
+	struct vhost_user_queue *vq;
+
+	assert(dev->vid == vid);
+
+	if (enable) {
+		vq = &dev->vqs[queue_id];
+
+		if (vq->enabled)
+			return 0;
+
+		vq->id = queue_id;
+
+		assert(rte_vhost_get_vhost_vring(dev->vid, queue_id,
+										&vq->vring) == 0);
+
+		assert(rte_vhost_get_vring_base(dev->vid, queue_id,
+						&vq->last_avail_idx,
+						&vq->last_used_idx) == 0);
+
+		vq->enabled = true;
+		/*
+		 * ctrl_handler MUST start when the virtqueue is enabled,
+		 * NOT start in new_device(). because driver will query some
+		 * informations through ctrl vq in ib_register_device() when
+		 * the device is not enabled.
+		 */
+		if (queue_id == VHOST_NET_ROCE_CTRL_QUEUE && !dev->ctrl_intr_registered) {
+			assert(rte_vhost_get_mem_table(vid, &dev->mem) == 0);
+			assert(dev->mem != NULL);
+
+			dev->ctrl_intr_handle.fd = dev->vqs[VHOST_NET_ROCE_CTRL_QUEUE].vring.kickfd;
+			dev->ctrl_intr_handle.type = RTE_INTR_HANDLE_EXT;
+			rte_intr_callback_register(&dev->ctrl_intr_handle,
+						vhost_rdma_handle_ctrl_vq, dev);
+			dev->ctrl_intr_registered = 1;
+		}
+	}
+	return 0;
+}
+
+static const struct rte_vhost_device_ops vhost_rdma_device_ops = {
+	.new_device =  vhost_rdma_new_device,
+	.destroy_device = vhost_rdma_destroy_device,
+	.new_connection = vhost_rdma_new_connection,
+	.vring_state_changed = vhost_rdma_vring_state_changed,
+};
+
+int vhost_rdma_construct(struct vhost_rdma_device *dev, const char *path, int idx)
+{
+	int ret;
+
+	unlink(path);
+
+	ret = rte_vhost_driver_register(path, 0);
+	if (ret != 0) {
+		RDMA_LOG_ERR("Socket %s already exists\n", path);
+		return ret;
+	}
+
+	ret = rte_vhost_driver_set_features(path, VHOST_RDMA_FEATURE);
+	if (ret != 0) {
+		RDMA_LOG_ERR("Set vhost driver features failed\n");
+		rte_vhost_driver_unregister(path);
+		return ret;
+	}
+
+	dev->stopped = false;
+	dev->inuse = 0;
+
+	/* set vhost user protocol features */
+	vhost_rdma_install_rte_compat_hooks(path);
+
+	dev->rdma_vqs = &dev->vqs[VHOST_NET_ROCE_CTRL_QUEUE];
+
+	vhost_rdma_net_construct(dev->vqs, idx);
+
+	vhost_rdma_init_ib(dev);
+	rte_spinlock_init(&dev->port_lock);
+
+	rte_vhost_driver_callback_register(path,
+					&vhost_rdma_device_ops);
+
+	for (int i = 0; i < VHOST_RDMA_NUM_OF_COUNTERS; i++) {
+		rte_atomic64_init(&dev->stats_counters[i]);
+	}
+
+	if(dev->tx_ring){
+		rte_eal_mp_remote_launch(vhost_rdma_task_scheduler, dev, SKIP_MAIN);
+	}
+
+	return 0;
+}