I recently added the support for CPU1 to the xilinx-zynq-a9 machine (hw/arm/xilinx_zynq.c). However, the reset behaviour doesn't match exactly with the hardware. After a system reset (SRST), the CPU1 should execute a wfe instruction and then load the start address from 0xfffffff0:
https://docs.amd.com/r/en-US/ug585-zynq-7000-SoC-TRM/Starting-Code-on-CPU-1 Sebastian Huber (2): hw/arm/boot: Use hooks if PSCI is disabled hw/arm/xilinx_zynq: Add CPU1 reset hw/arm/boot.c | 30 +++++++++++++++++++----------- hw/arm/xilinx_zynq.c | 25 +++++++++++++++++++++++++ 2 files changed, 44 insertions(+), 11 deletions(-) -- 2.35.3