1、std_svc_setup （主要關注設置psci操作集）--有服務

std_svc_setup  //services/std_svc/std_svc_setup.c
- >psci_setup //lib/psci/psci_setup.c
 - >plat_setup_psci_ops   //設置平臺的ｐｓｃｉ操作    調用平臺的plat_setup_psci_ops函數去設置ｐｓｃｉ操作 ｅｇ:qemu平臺
  - >*psci_ops = &plat_qemu_psci_pm_ops;
   208 static const plat_psci_ops_t plat_qemu_psci_pm_ops = {
    209         .cpu_standby = qemu_cpu_standby,
    210         .pwr_domain_on = qemu_pwr_domain_on,
    211         .pwr_domain_off = qemu_pwr_domain_off, 
    212         .pwr_domain_suspend = qemu_pwr_domain_suspend,
    213         .pwr_domain_on_finish = qemu_pwr_domain_on_finish,
    214         .pwr_domain_suspend_finish = qemu_pwr_domain_suspend_finish,
    215         .system_off = qemu_system_off,
    216         .system_reset = qemu_system_reset, 
    217         .validate_power_state = qemu_validate_power_state,
    218         .validate_ns_entrypoint = qemu_validate_ns_entrypoint
    219 };

在遍歷每一個注冊的運行時服務的時候，會導致std_svc_setup調用，其中會做psci操作集的設置，操作集中我們可以看到對核電源的管理的接口如：核上電，下電，掛起等，我們主要關注上電 .pwr_domain_on = qemu_pwr_domain_on,這個接口當我們主處理器boot從處理器的時候會用到。

2、運行時服務觸發和處理--來請求

smc指令觸發進入el3異常向量表：

runtime_exceptions  //ｅｌ3的異常向量表
－ >sync_exception_aarch64
- >handle_sync_exception
- >smc_handler64
- >   |* Populate the parameters for the SMC handler.
          |* We already have x0-x4 in place. x5 will point to a cookie (not used
          |* now). x6 will point to the context structure (SP_EL3) and x7 will
          |* contain flags we need to pass to the handler Hence save x5-x7.
          |*
          |* Note: x4 only needs to be preserved for AArch32 callers but we do it
          |*       for AArch64 callers as well for convenience
       |*/
         stp     x4, x5, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X4]  //保存x4－ｘ7到棧
         stp     x6, x7, [sp, #CTX_GPREGS_OFFSET + CTX_GPREG_X6]

       /* Save rest of the gpregs and sp_el0*/
         save_x18_to_x29_sp_el0

       mov     x5, xzr  //x5清零
       mov     x6, sp //ｓｐ保存在x6

       /* Get the unique owning entity number */ //獲得唯一的入口編號
         ubfx    x16, x0, #FUNCID_OEN_SHIFT, #FUNCID_OEN_WIDTH
         ubfx    x15, x0, #FUNCID_TYPE_SHIFT, #FUNCID_TYPE_WIDTH
         orr     x16, x16, x15, lsl #FUNCID_OEN_WIDTH

         adr     x11, (__RT_SVC_DESCS_START__ + RT_SVC_DESC_HANDLE)

       /* Load descriptor index from array of indices */
         adr     x14, rt_svc_descs_indices  //獲得服務描述 標識數組
         ldrb    w15, [x14, x16] //根據唯一的入口編號 找到處理函數的 地址
       /*
       |* Restore the saved C runtime stack value which will become the new
       |* SP_EL0 i.e. EL3 runtime stack. It was saved in the 'cpu_context'
       |* structure prior to the last ERET from EL3.
       |*/
         ldr     x12, [x6, #CTX_EL3STATE_OFFSET + CTX_RUNTIME_SP]

       /*
       |* Any index greater than 127 is invalid. Check bit 7 for
       |* a valid index
       |*/
         tbnz    w15, 7, smc_unknown

       /* Switch to SP_EL0 */
         msr     spsel, #0  

          /*
          |* Get the descriptor using the index
          |* x11 = (base + off), x15 = index
          |*
          |* handler = (base + off) + (index < < log2(size))
       |*/
       lsl     w10, w15, #RT_SVC_SIZE_LOG2
         ldr     x15, [x11, w10, uxtw]

       /*
       |* Save the SPSR_EL3, ELR_EL3, & SCR_EL3 in case there is a world
       |* switch during SMC handling.
       |* TODO: Revisit if all system registers can be saved later.
       |*/
   mrs     x16, spsr_el3 //spsr_el3保存在x16
    mrs     x17, elr_el3 //elr_el3保存在x17
   mrs     x18, scr_el3  //scr_el3保存在x18
         stp     x16, x17, [x6, #CTX_EL3STATE_OFFSET + CTX_SPSR_EL3]  /  x16, x17/保存在棧
       str     x18, [x6, #CTX_EL3STATE_OFFSET + CTX_SCR_EL3] //x18保存到棧

       /* Copy SCR_EL3.NS bit to the flag to indicate caller's security */
         bfi     x7, x18, #0, #1

       mov     sp, x12 

       /*
       |* Call the Secure Monitor Call handler and then drop directly into
       |* el3_exit() which will program any remaining architectural state
       |* prior to issuing the ERET to the desired lower EL.
       |*/
#if DEBUG
         cbz     x15, rt_svc_fw_critical_error
#endif
         blr     x15  //跳轉到處理函數

         b       el3_exit  //從ｅｌ3退出  會ｅｒｅｔ 回到ｅｌ1 （后面會講到）

3、找到對應handler--請求匹配處理函數

上面其實主要的是找到服務例程，然后跳轉執行 下面是跳轉的處理函數：

std_svc_smc_handler  //services/std_svc/std_svc_setup.c
- >ret = psci_smc_handler(smc_fid, x1, x2, x3, x4,
                  |   cookie, handle, flags)
                  ...
 480         } else {
481                 /* 64-bit PSCI function */
  482 
  483                 switch (smc_fid) {
  484                 case PSCI_CPU_SUSPEND_AARCH64:
  485                         ret = (u_register_t)
  486                                 psci_cpu_suspend((unsigned int)x1, x2, x3);
  487                         break;
  488 
  489                 case PSCI_CPU_ON_AARCH64:
  490                         ret = (u_register_t)psci_cpu_on(x1, x2, x3);
  491                         break;
  492 
...
}