pmap_sremove_pages() would better match the names of the native routines. pmap_remove_all() removes all managed mappings of a given page.

Can we have a block here? pmap_senter() does not create them.

Debug printf

Also don't we need to unwire the L3 page once for each valid entry?

Thanks, renamed!

Not needed. So I removed it.
Thanks!

I could not find any debug printf macro, do we have any ?

This function is called when no L3 pages are mapped, so if any valid L3 page present it just returns error and pmap will not be released by IOMMU code.
(we can replace to panic, any other ideas ?)

Why is the user bit being set?

It's not necessary to do any kind of TLB invalidation here?

These declarations of type vm_page_t can be in a single line.

Can't we stop iterating once sva > VM_MAXUSER_ADDRESS?

I see. If this condition is not expected to occur it should be a panic(). If you want to keep the printf() I'd put it under ifdef DIAGNOSTIC.

Maybe because iommu addresses are below VM_MAXUSER_ADDRESS ?

I receive this event otherwise (i.e. without ATTR_S1_AP_USER bit):
smmu0: Event F_PERMISSION (Permission fault occurred on page access.) received.

SMMU has its own TLB that can be invalidated in the SMMU driver only, so we proceed invalidatation in the driver just after calling this function.

Fixed.

Sure!

Ok, I've replaced the printf call with panic()

The bit controls access permission from EL0. I'm not sure how that meaning is translated when using the SMMU.

We should modify the pmap's resident count here.

Yes, I think ATTR_S1_AP_USER instructs SMMU to use page table base register from TTB0 register.
We only set pointer to page directory in TTB0 register of a context descriptor, and TTB1 is zero.

Added here and in pmap_sremove().