Add VhostUserRng device implementation

Implements a vhost-user RNG device as a thin
wrapper around the core VhostUserDevice. The
VMM now switches between the standard RNG device
and vhost-user RNG depending on whether a socket
path is configured via krun_add_vhost_user_device()

This allows us to use the RNG device from the
rust-vmm vhost-device running in a separate
process for better isolation and flexibility.

Signed-off-by: Dorinda Bassey <dbassey@redhat.com>

Author: Dorinda Bassey

src/devices/src/virtio/mod.rs

@@ -59,7 +59,7 @@ pub use self::rng::*;
 #[cfg(feature = "snd")]
 pub use self::snd::Snd;
 #[cfg(feature = "vhost-user")]
-pub use self::vhost_user::VhostUserDevice;
+pub use self::vhost_user::{VhostUserDevice, VhostUserRng};
 pub use self::vsock::*;
 
 /// When the driver initializes the device, it lets the device know about the

src/devices/src/virtio/vhost_user/mod.rs

@@ -7,5 +7,7 @@
 //! to run in separate processes for better isolation and flexibility.
 
 mod device;
+mod rng;
 
 pub use device::VhostUserDevice;
+pub use rng::VhostUserRng;

src/devices/src/virtio/vhost_user/rng.rs

@@ -0,0 +1,129 @@
+// Copyright 2026, Red Hat Inc. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! Vhost-user RNG device implementation.
+
+use crate::io::{Error, ErrorKind};
+use std::io::Result as IoResult;
+
+use vm_memory::GuestMemoryMmap;
+
+use super::device::VhostUserDevice;
+use crate::virtio::{ActivateResult, InterruptTransport, Queue as VirtQueue, VirtioDevice};
+
+// RNG device constants
+const RNG_DEV_ID: &str = "vhost_user_rng";
+const NUM_QUEUES: usize = 1;
+const QUEUE_SIZES: &[u16] = &[256; NUM_QUEUES];
+const VIRTIO_ID_RNG: u32 = 4;
+
+/// Vhost-user RNG device.
+///
+/// This is a thin wrapper around VhostUserDevice specialized for the RNG device type.
+pub struct VhostUserRng {
+    inner: VhostUserDevice,
+}
+
+impl VhostUserRng {
+    /// Create a new vhost-user RNG device.
+    ///
+    /// # Arguments
+    ///
+    /// * `socket_path` - Path to the vhost-user Unix domain socket
+    /// * `name` - Device name for logging (None = use default "vhost_user_rng")
+    /// * `num_queues` - Number of virtqueues (0 = use default)
+    /// * `queue_sizes` - Size of each queue (empty slice = use defaults)
+    pub fn new(
+        socket_path: &str,
+        name: Option<String>,
+        num_queues: u16,
+        queue_sizes: &[u16],
+    ) -> IoResult<Self> {
+        let (actual_num_queues, actual_queue_sizes): (usize, &[u16]) =
+            if num_queues == 0 || queue_sizes.is_empty() {
+                (NUM_QUEUES, QUEUE_SIZES)
+            } else {
+                (num_queues as usize, queue_sizes)
+            };
+
+        if actual_num_queues == 0 || actual_queue_sizes.len() != actual_num_queues {
+            return Err(Error::new(
+                ErrorKind::InvalidInput,
+                format!(
+                    "Invalid queue configuration: num_queues={}, queue_sizes.len()={}",
+                    actual_num_queues,
+                    actual_queue_sizes.len()
+                ),
+            ));
+        }
+
+        let queues: Vec<VirtQueue> = actual_queue_sizes
+            .iter()
+            .map(|&max_size| VirtQueue::new(max_size))
+            .collect();
+
+        let device_name = name.unwrap_or_else(|| RNG_DEV_ID.to_string());
+
+        let inner = VhostUserDevice::new(socket_path, VIRTIO_ID_RNG, device_name, queues)?;
+
+        Ok(VhostUserRng { inner })
+    }
+
+    pub fn id(&self) -> &str {
+        RNG_DEV_ID
+    }
+}
+
+impl VirtioDevice for VhostUserRng {
+    fn device_type(&self) -> u32 {
+        self.inner.device_type()
+    }
+
+    fn device_name(&self) -> &str {
+        self.inner.device_name()
+    }
+
+    fn queues(&self) -> &[VirtQueue] {
+        self.inner.queues()
+    }
+
+    fn queues_mut(&mut self) -> &mut [VirtQueue] {
+        self.inner.queues_mut()
+    }
+
+    fn queue_events(&self) -> &[utils::eventfd::EventFd] {
+        self.inner.queue_events()
+    }
+
+    fn avail_features(&self) -> u64 {
+        self.inner.avail_features()
+    }
+
+    fn acked_features(&self) -> u64 {
+        self.inner.acked_features()
+    }
+
+    fn set_acked_features(&mut self, acked_features: u64) {
+        self.inner.set_acked_features(acked_features)
+    }
+
+    fn read_config(&self, offset: u64, data: &mut [u8]) {
+        self.inner.read_config(offset, data)
+    }
+
+    fn write_config(&mut self, offset: u64, data: &[u8]) {
+        self.inner.write_config(offset, data)
+    }
+
+    fn activate(&mut self, mem: GuestMemoryMmap, interrupt: InterruptTransport) -> ActivateResult {
+        self.inner.activate(mem, interrupt)
+    }
+
+    fn is_activated(&self) -> bool {
+        self.inner.is_activated()
+    }
+
+    fn reset(&mut self) -> bool {
+        self.inner.reset()
+    }
+}

src/vmm/src/builder.rs

@@ -976,7 +976,28 @@ pub fn build_microvm(
     #[cfg(not(feature = "tee"))]
     attach_balloon_device(&mut vmm, event_manager, intc.clone())?;
     #[cfg(not(feature = "tee"))]
-    attach_rng_device(&mut vmm, event_manager, intc.clone())?;
+    {
+        #[cfg(feature = "vhost-user")]
+        {
+            const VIRTIO_ID_RNG: u32 = 4;
+
+            let has_vhost_user_rng = vm_resources
+                .vhost_user_devices
+                .iter()
+                .any(|dev| dev.device_type == VIRTIO_ID_RNG);
+
+            if has_vhost_user_rng {
+                for device_config in &vm_resources.vhost_user_devices {
+                    attach_vhost_user_device(&mut vmm, intc.clone(), device_config)?;
+                }
+            } else {
+                attach_rng_device(&mut vmm, event_manager, intc.clone())?;
+            }
+        }
+
+        #[cfg(not(feature = "vhost-user"))]
+        attach_rng_device(&mut vmm, event_manager, intc.clone())?;
+    }
     let mut console_id = 0;
     if !vm_resources.disable_implicit_console {
         attach_console_devices(
@@ -2388,6 +2409,62 @@ fn attach_rng_device(
     Ok(())
 }
 
+#[cfg(not(feature = "tee"))]
+#[cfg(feature = "vhost-user")]
+fn attach_vhost_user_device(
+    vmm: &mut Vmm,
+    intc: IrqChip,
+    device_config: &VhostUserDeviceConfig,
+) -> std::result::Result<(), StartMicrovmError> {
+    use self::StartMicrovmError::*;
+
+    const VIRTIO_ID_RNG: u32 = 4;
+    const VIRTIO_ID_SND: u32 = 25;
+    const VIRTIO_ID_CAN: u32 = 36;
+
+    match device_config.device_type {
+        VIRTIO_ID_RNG => {
+            let rng = Arc::new(Mutex::new(
+                devices::virtio::VhostUserRng::new(
+                    &device_config.socket_path,
+                    device_config.name.clone(),
+                    device_config.num_queues,
+                    &device_config.queue_sizes,
+                )
+                .map_err(|e| RegisterRngDevice(device_manager::mmio::Error::VhostUserDevice(e)))?,
+            ));
+
+            let id = String::from(rng.lock().unwrap().id());
+            attach_mmio_device(vmm, id, intc.clone(), rng).map_err(RegisterRngDevice)?;
+        }
+        VIRTIO_ID_SND | VIRTIO_ID_CAN => {
+            // TODO: Implement when vhost-user sound/CAN device wrappers are added
+            return Err(RegisterRngDevice(
+                device_manager::mmio::Error::VhostUserDevice(std::io::Error::new(
+                    std::io::ErrorKind::Unsupported,
+                    format!(
+                        "Vhost-user device type {} not yet implemented",
+                        device_config.device_type
+                    ),
+                )),
+            ));
+        }
+        _ => {
+            return Err(RegisterRngDevice(
+                device_manager::mmio::Error::VhostUserDevice(std::io::Error::new(
+                    std::io::ErrorKind::InvalidInput,
+                    format!(
+                        "Unknown vhost-user device type {}",
+                        device_config.device_type
+                    ),
+                )),
+            ));
+        }
+    }
+
+    Ok(())
+}
+
 #[cfg(feature = "gpu")]
 #[allow(clippy::too_many_arguments)]
 fn attach_gpu_device(

src/vmm/src/device_manager/kvm/mmio.rs

@@ -41,6 +41,9 @@ pub enum Error {
     DeviceNotFound,
     /// Failed to update the mmio device.
     UpdateFailed,
+    /// Failed to create vhost-user device.
+    #[cfg(feature = "vhost-user")]
+    VhostUserDevice(io::Error),
 }
 
 impl fmt::Display for Error {
@@ -59,6 +62,8 @@ impl fmt::Display for Error {
             Error::RegisterIrqFd(ref e) => write!(f, "failed to register irqfd: {e}"),
             Error::DeviceNotFound => write!(f, "the device couldn't be found"),
             Error::UpdateFailed => write!(f, "failed to update the mmio device"),
+            #[cfg(feature = "vhost-user")]
+            Error::VhostUserDevice(ref e) => write!(f, "failed to create vhost-user device: {e}"),
         }
     }
 }