How to map a PA into EL3's VA space?

By checking the data, I know that all physical memory can be accessed in el3 privilege mode. Now I have known the physical address of a block of allocated memory area in the kernel, and have passed the physical address to el3 through SMC, but I find that MMU is also turned on in el3, and I find that the virtual address and physical address in el3 are the same by printing tf_xlat_table. But I still haven't found a way to map the physical address to el3's virtual address space.
More questions in this forum