ARMv8-A: Some questions of changing exception level.

Hi, I do really upset for a long time because of failing to change the exception level from EL2 to EL1/EL0.

The processor is cortex-A53 and the board is i.MX8M, I have begun to suspect that it is the problem of hardware.

It starts up in EL2. I try to use the following code to change it to EL1:

    .macro	arm64_el2_to_el1

	/* set a vaild sp_el0 */
	/* it is just a temp way */
	mov x6, sp
	sub x6,x6, #4096
	msr	sp_el0, x6	

	/* always use SP_EL0 */
	msr	SPsel, #0	
	
	
	bl print2               //debug
	
	/* lower EL is 64bits */
    mov x4, #(1 << 31)
    msr hcr_el2, x4


	/* set RES1 */
    mov x4, #0x0800
    movk x4, #0x30d0, lsl #16
    msr sctlr_el1, x4

	/* little Endianness in translation table walk */
	mrs	x0, sctlr_el2
	bic x0, x0, #(1 << 25)   // Clear the EE bit for EL2
	msr    sctlr_el2, x0

	/* trap from EL1h, mask synchronize exception/SError/IRQ/FIQ */
	mov x4, #0x3c4
	msr spsr_el2, x4

	/* holds the address to return to */
	adr x4, 1f
	msr elr_el2, x4

	bl print3

	eret

1:

	bl print1
	.endm

* The function printx is to print number x through UART on board.
* In fact, I don't want to use SP_EL0 forever, but it is easy to test changing EL.

I test so many times and come to the following conclusions:

1. when the spsr_el2 is set to 0x3c8, which means that we will return to the same EL(EL2). And it works. the print is 2,3,1.
2. when the spsr_el2 is set to 0x3c4, which means that we will change the EL to EL1. However, it just print 2,3 and nothing.

I have no idea what should I do next, can you give me some help?

Thanks a lot.