After enable mmu, a translation fault occur when I try to run OS in EL2 (VHE mode) with cortex-a55(armv8.1)

hello, arm expert.

I try to run a zephyr os in aarch64 el2 mode on armv8.1 cpu (cortex-a55). Zephyr can run successful in aarch64 el1 mode on cortex-a55 platform, And as I know, when enable armv8.1 VHE mode, a os can successful run in el2 mode  without change the xxx_elx register if it can run successful in el1 mode before. So I do the test, but error occur below: 

Through enable VHE mode, Zephyr can run success before enable mmu, but after I write sctlr_el2, things go wrong, and I get a translation fault. The error code seems that it is level3 translation falut, But when I check the far_el2 register , it always keep a fault address where the '_image_ram_end' is(It means that when I try to change the _image_ram_end' address, the value of the fat_el2 keep change with it. I am so confused because when I set addr mapping when build page table , The address of this '_image_ram_end' has no valid address ). It should be noted that '__image_ram_end' is a address where my os kernel segment's end address locate, and in this experience, I use a idmap from virtual address  to physical address so I think it not a valid address. Below are some of  my register infomation after fault occur:

• esr_el2: 0x96000047 (EC is 100101, translation fault level3)
• far_el2: 0x40019000  (where the 'image_ram_end' address)

Before enable mmu, some of register information are below:

• sctlr_el2: 0x30c51838 
• ttbr0_el2: 0x40008000 (It need to note that I just use one ttbr register here)
• tcr_el2: 0x00000005-00803510 
• spsr_el2: 0x000003c4
• id_aa64mmfr1_el1: 0x10212122
• id_aa64mmfr0_el1: 0x00101122
• hcr_el2: 0x00000004-88000002

I would like to know below question:

1. Can i run the unmodified os  in el2 with vhe mode? Of course i failed on this experiment, but i think it possibly because i make wrong configuration to memory related register.
2.  When i google similar problems, some of people said that it may be due to the pc get the unmaped address, but the question is, on my experiment, the address that make this problem(i think) seems strange and locate the data segment's end address every time. If these people's point is ture, why pc get a strange value after enable mmu?
3. Some of people said that it may be caused by date cache, so before i write sctlr_el2 i invalid all the cache, and even disable cache flag in sctlr_el2 register, but it not work.
4. Because I want to know if it's really due to this instruction (msr sctlr_el2, x0) cause the falut, I write a 'hvc #0' call after the enable mmu code, it seems system cannot run to this instruction, So i firmly believe that the fault is caused by (msr sctlr, x0) instructon. below is my code when enable mmu .

Thank you.