vhost_init_device_iotlb() currently replaces an existing device IOTLB
with a new empty table. A later VHOST_SET_FEATURES update, such as a
logging change while ACCESS_PLATFORM remains enabled, can therefore
discard valid translations.

Make device IOTLB initialization idempotent and add a common teardown
helper for the inverse transition. The helper detaches the table from
all virtqueues, resets their metadata caches, clears queued IOTLB miss
messages, and frees the old table after the virtqueue handoff. It is a
no-op when no device IOTLB is installed, so callers do not need to inspect
that internal state.

Callers must hold the device mutex. The helper does not update
acknowledged features; backend-specific code continues to do that.

Fixes: 6b1e6cc7855b ("vhost: new device IOTLB API")
Signed-off-by: Jia Jia <physicalmtea@gmail.com>
---
 drivers/vhost/vhost.c | 30 ++++++++++++++++++++++++++++++
 drivers/vhost/vhost.h |  1 +
 2 files changed, 31 insertions(+)

diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index cda5c350d9be..61676987ad58 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -2451,6 +2451,32 @@ long vhost_vring_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *arg
 }
 EXPORT_SYMBOL_GPL(vhost_vring_ioctl);
 
+/* Caller must hold the device mutex. */
+void vhost_clear_device_iotlb(struct vhost_dev *d)
+{
+	struct vhost_iotlb *iotlb;
+	int i;
+
+	iotlb = d->iotlb;
+	if (!iotlb)
+		return;
+	d->iotlb = NULL;
+
+	for (i = 0; i < d->nvqs; ++i) {
+		struct vhost_virtqueue *vq = d->vqs[i];
+
+		mutex_lock(&vq->mutex);
+		vq->iotlb = NULL;
+		__vhost_vq_meta_reset(vq);
+		mutex_unlock(&vq->mutex);
+	}
+
+	vhost_clear_msg(d);
+	vhost_iotlb_free(iotlb);
+	wake_up_interruptible_poll(&d->wait, EPOLLIN | EPOLLRDNORM);
+}
+EXPORT_SYMBOL_GPL(vhost_clear_device_iotlb);
+
 static bool vhost_retry_iotlb_misses(struct vhost_dev *d)
 {
 	bool wake = false;
@@ -2475,12 +2501,16 @@ static bool vhost_retry_iotlb_misses(struct vhost_dev *d)
 	return wake;
 }
 
+/* Caller must hold the device mutex. */
 int vhost_init_device_iotlb(struct vhost_dev *d)
 {
 	struct vhost_iotlb *niotlb, *oiotlb;
 	bool wake;
 	int i;
 
+	if (d->iotlb)
+		return 0;
+
 	niotlb = iotlb_alloc();
 	if (!niotlb)
 		return -ENOMEM;
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 50fccc85d594..a3c598a79251 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -283,6 +283,7 @@ ssize_t vhost_chr_read_iter(struct vhost_dev *dev, struct iov_iter *to,
 			    int noblock);
 ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
 			     struct iov_iter *from);
+void vhost_clear_device_iotlb(struct vhost_dev *d);
 int vhost_init_device_iotlb(struct vhost_dev *d);
 
 void vhost_iotlb_map_free(struct vhost_iotlb *iotlb,