diff --git a/ready-to-run/riscv64-nemu-interpreter-so b/ready-to-run/riscv64-nemu-interpreter-so
index 2ccf6abe..935c3515 100755
Binary files a/ready-to-run/riscv64-nemu-interpreter-so and b/ready-to-run/riscv64-nemu-interpreter-so differ
diff --git a/src/main/scala/nutcore/backend/fu/CSR.scala b/src/main/scala/nutcore/backend/fu/CSR.scala
index e8dd1a50..08dfef01 100644
--- a/src/main/scala/nutcore/backend/fu/CSR.scala
+++ b/src/main/scala/nutcore/backend/fu/CSR.scala
@@ -65,6 +65,9 @@ trait HasCSRConst {
   val Stvec         = 0x105
   val Scounteren    = 0x106
 
+  // Supervisor Configuration
+  val Senvcfg       = 0x10A
+
   // Supervisor Trap Handling
   val Sscratch      = 0x140
   val Sepc          = 0x141
@@ -90,6 +93,9 @@ trait HasCSRConst {
   val Mtvec         = 0x305
   val Mcounteren    = 0x306
 
+  // Machine Configuration
+  val Menvcfg       = 0x30A
+
   // Machine Trap Handling
   val Mscratch      = 0x340
   val Mepc          = 0x341
@@ -97,14 +103,6 @@ trait HasCSRConst {
   val Mtval         = 0x343
   val Mip           = 0x344
 
-  // Machine Memory Protection
-  // TBD
-  val Pmpcfg0       = 0x3A0
-  val Pmpcfg1       = 0x3A1
-  val Pmpcfg2       = 0x3A2
-  val Pmpcfg3       = 0x3A3
-  val PmpaddrBase   = 0x3B0
-
   // Machine Counter/Timers
   val Mcycle        = 0xb00
   val Minstret      = 0xb02
@@ -256,6 +254,7 @@ class CSR(implicit val p: NutCoreConfig) extends NutCoreModule with HasCSRConst{
 
   val mtvec = RegInit(UInt(XLEN.W), 0.U)
   val mcounteren = RegInit(UInt(XLEN.W), 0.U)
+  val menvcfg = 0.U(XLEN.W)
   val mcause = RegInit(UInt(XLEN.W), 0.U)
   val mtval = RegInit(UInt(XLEN.W), 0.U)
   val mepc = RegInit(UInt(XLEN.W), 0.U)
@@ -327,16 +326,6 @@ class CSR(implicit val p: NutCoreConfig) extends NutCoreModule with HasCSRConst{
   val mideleg = RegInit(UInt(XLEN.W), 0.U)
   val mscratch = RegInit(UInt(XLEN.W), 0.U)
 
-  val pmpcfg0 = RegInit(UInt(XLEN.W), 0.U)
-  val pmpcfg1 = RegInit(UInt(XLEN.W), 0.U)
-  val pmpcfg2 = RegInit(UInt(XLEN.W), 0.U)
-  val pmpcfg3 = RegInit(UInt(XLEN.W), 0.U)
-  val pmpaddr0 = RegInit(UInt(XLEN.W), 0.U)
-  val pmpaddr1 = RegInit(UInt(XLEN.W), 0.U)
-  val pmpaddr2 = RegInit(UInt(XLEN.W), 0.U)
-  val pmpaddr3 = RegInit(UInt(XLEN.W), 0.U)
-  val pmpaddrWmask = "h3fffffff".U(64.W) // 32bit physical address
-
   // Superviser-Level CSRs
 
   // val sstatus = RegInit(UInt(XLEN.W), "h00000000".U)
@@ -367,6 +356,7 @@ class CSR(implicit val p: NutCoreConfig) extends NutCoreModule with HasCSRConst{
   val stval = Reg(UInt(XLEN.W))
   val sscratch = RegInit(UInt(XLEN.W), 0.U)
   val scounteren = RegInit(UInt(XLEN.W), 0.U)
+  val senvcfg = 0.U(XLEN.W)
 
   if (Settings.get("HasDTLB")) {
     BoringUtils.addSource(satp, "CSRSATP")
@@ -438,7 +428,8 @@ class CSR(implicit val p: NutCoreConfig) extends NutCoreModule with HasCSRConst{
     // MaskedRegMap(Sideleg, Sideleg),
     MaskedRegMap(Sie, mie, sieMask, MaskedRegMap.NoSideEffect, sieMask),
     MaskedRegMap(Stvec, stvec),
-    MaskedRegMap(Scounteren, scounteren),
+    MaskedRegMap(Scounteren, scounteren, "h7".U(XLEN.W)),
+    MaskedRegMap(Senvcfg, senvcfg, 0.U, MaskedRegMap.Unwritable),
 
     // Supervisor Trap Handling
     MaskedRegMap(Sscratch, sscratch),
@@ -459,11 +450,12 @@ class CSR(implicit val p: NutCoreConfig) extends NutCoreModule with HasCSRConst{
     // Machine Trap Setup
     MaskedRegMap(Mstatus, mstatus, mstatusWMask, mstatusUpdateSideEffect),
     MaskedRegMap(Misa, misa, 0.U, MaskedRegMap.Unwritable),
-    MaskedRegMap(Medeleg, medeleg, "hbbff".U(64.W)),
+    MaskedRegMap(Medeleg, medeleg, "hcb3ff".U(64.W)),
     MaskedRegMap(Mideleg, mideleg, "h222".U(64.W)),
     MaskedRegMap(Mie, mie),
     MaskedRegMap(Mtvec, mtvec),
-    MaskedRegMap(Mcounteren, mcounteren),
+    MaskedRegMap(Mcounteren, mcounteren, "h7".U(XLEN.W)),
+    MaskedRegMap(Menvcfg, menvcfg, 0.U, MaskedRegMap.Unwritable),
 
     // Machine Trap Handling
     MaskedRegMap(Mscratch, mscratch),
@@ -472,16 +464,6 @@ class CSR(implicit val p: NutCoreConfig) extends NutCoreModule with HasCSRConst{
     MaskedRegMap(Mtval, mtval),
     MaskedRegMap(Mip, mip.asUInt, 0.U, MaskedRegMap.Unwritable),
 
-    // Machine Memory Protection
-    MaskedRegMap(Pmpcfg0, pmpcfg0),
-    MaskedRegMap(Pmpcfg1, pmpcfg1),
-    MaskedRegMap(Pmpcfg2, pmpcfg2),
-    MaskedRegMap(Pmpcfg3, pmpcfg3),
-    MaskedRegMap(PmpaddrBase + 0, pmpaddr0, pmpaddrWmask),
-    MaskedRegMap(PmpaddrBase + 1, pmpaddr1, pmpaddrWmask),
-    MaskedRegMap(PmpaddrBase + 2, pmpaddr2, pmpaddrWmask),
-    MaskedRegMap(PmpaddrBase + 3, pmpaddr3, pmpaddrWmask),
-
     // Machine Counter/Timers
     MaskedRegMap(Mcycle, mcycle),
     MaskedRegMap(Minstret, minstret)
@@ -711,6 +693,7 @@ class CSR(implicit val p: NutCoreConfig) extends NutCoreModule with HasCSRConst{
   // val delegS = ((deleg & (1 << (causeNO & 0xf))) != 0) && (privilegeMode < ModeM);
   val delegS = (deleg(causeNO(3,0))) && (privilegeMode < ModeM)
   val tvalWen = !(hasInstrPageFault || hasLoadPageFault || hasStorePageFault || hasLoadAddrMisaligned || hasStoreAddrMisaligned) || raiseIntr // in nutcore-riscv64, no exception will come together with PF
+  val trapXtval = Mux(!raiseIntr && raiseExceptionVec(breakPoint), SignExt(io.cfIn.pc(VAddrBits-1, 0), XLEN), 0.U)
 
   ret := isMret || isSret || isUret
   trapTarget := Mux(delegS, stvec, mtvec)(VAddrBits-1, 0)
@@ -766,7 +749,7 @@ class CSR(implicit val p: NutCoreConfig) extends NutCoreModule with HasCSRConst{
       mstatusNew.pie.s := mstatusOld.ie.s
       mstatusNew.ie.s := false.B
       privilegeMode := ModeS
-      when(tvalWen){stval := 0.U} // TODO: should not use =/=
+      when(tvalWen){stval := trapXtval}
       // printf("[*] mstatusNew.spp %x\n", mstatusNew.spp)
       // trapTarget := stvec(VAddrBits-1. 0)
     }.otherwise {
@@ -776,7 +759,7 @@ class CSR(implicit val p: NutCoreConfig) extends NutCoreModule with HasCSRConst{
       mstatusNew.pie.m := mstatusOld.ie.m
       mstatusNew.ie.m := false.B
       privilegeMode := ModeM
-      when(tvalWen){mtval := 0.U} // TODO: should not use =/=
+      when(tvalWen){mtval := trapXtval}
       // trapTarget := mtvec(VAddrBits-1. 0)
     }
     // mstatusNew.pie.m := LookupTree(privilegeMode, List(