Can't enable mmu in armv8 EL2 mode

[cocoeoli]

I try to run the whole zephyr in el2 mode on armv8 cpu (cortex-a55). Through enable VHE mode, Zephyr can run success before enable mmu, but after I write sctlr_el2, things go wrong, and I get a translation fault. The error code seems that it is level3 translation falut, But when I check the far_el2 register , it always keep the fault address where the '_image_ram_end' is(It means that when I try to change the _image_ram_end' address, the value of the fat_el2 keep change with it. I am so confused because when I set addr map, The address of this '_image_ram_end' has no code ).
So I want to know is there any addition operation I need do to prevent this fault and let the pc get the right value after enable mmu.
Below is my debug_uart output for some of register:(below el1 are changed to el2)

Below is the memory layout of zephyr, and '_image_ram_end' is the end address of zephyr_date.

So the second question is that I want to know is there any situation may make the pc get the wrong virtual address after enable mmu?