The SMMU offers isolation services in addition to its address translation features. The two-stage address translation for I/O devices can also affect the transaction context. The SMMU also provides transaction filtering to isolate the transactions masters.
To offer isolation and memory protection, the SMMU restricts device access of DMA-capable I/O to a configured physical address space.
The protection features are described in the SMMU Protection on CCI Slave Ports section. The address translation functions are described in the System Memory Virtualization Using SMMU Address Translation section in Application Processing Unit.