I found the mmio access api in arm-tf/include/lib/mmio.h, it access the addr to perform I/O operations like many other privileged softwares (linux, optee-os, etc.):

static inline void mmio_write_32(uintptr_t addr, uint32_t value)
{
    *(volatile uint32_t*)addr = value;
}

static inline uint32_t mmio_read_32(uintptr_t addr)
{
    return *(volatile uint32_t*)addr;
}

As far as I know, the addr should be a virtual memory address, and MMU translates it to a physical address, then read/write on the MMIO address.

Taking the following code as an example. It seems that atf takes SMMUv3’s MMIO physical address as the addr, and directly access the MMIO physical address:

#define PLAT_FVP_SMMUV3_BASE        UL(0x2b400000)

smmuv3_init(PLAT_FVP_SMMUV3_BASE);

int __init smmuv3_init(uintptr_t smmu_base)
{
    /* Abort all incoming transactions */
    if (smmuv3_security_init(smmu_base) != 0)
        return -1;

    /* Check if the SMMU supports secure state */
    if ((mmio_read_32(smmu_base + SMMU_S_IDR1) &
                SMMU_S_IDR1_SECURE_IMPL) == 0U)
        return 0;
    /*
     * Initiate invalidation of secure caches and TLBs if the SMMU
     * supports secure state. If not, it's implementation defined
     * as to how SMMU_S_INIT register is accessed.
     */
    mmio_write_32(smmu_base + SMMU_S_INIT, SMMU_S_INIT_INV_ALL);

    /* Wait for global invalidation operation to finish */
    return smmuv3_poll(smmu_base + SMMU_S_INIT,
                SMMU_S_INIT_INV_ALL, 0U);
}

Maybe I have missed some knowledge of memory management. Is this because Arm Trusted Firmware has a higher privilege level (EL3)? Or there are no MMU configuration in Arm Trusted Firmware, so it can access physical memory directly?