diff --git a/src/main/scala/xiangshan/backend/roq/Roq.scala b/src/main/scala/xiangshan/backend/roq/Roq.scala
index 578458f42fa650c2e787b23a39fc3b7cb0a03b27..b60fd9653563225c6ae0310c57e15f73e942e5b6 100644
--- a/src/main/scala/xiangshan/backend/roq/Roq.scala
+++ b/src/main/scala/xiangshan/backend/roq/Roq.scala
@@ -365,6 +365,7 @@ class Roq(numWbPorts: Int) extends XSModule with HasCircularQueuePtrHelper {
 
   // when exception occurs, cancels all
   when (io.redirect.valid) { // TODO: need check for flushPipe
+    state := s_idle
     enqPtrExt := 0.U.asTypeOf(new RoqPtr)
     deqPtrExt := 0.U.asTypeOf(new RoqPtr)
   }
diff --git a/src/main/scala/xiangshan/cache/dtlb.scala b/src/main/scala/xiangshan/cache/dtlb.scala
index 7239c3af5f9ada64b2b5324382c74be20c930516..8b2fa13a710aafaa7bed16195cb653525089b8bd 100644
--- a/src/main/scala/xiangshan/cache/dtlb.scala
+++ b/src/main/scala/xiangshan/cache/dtlb.scala
@@ -273,8 +273,32 @@ class TLB(Width: Int, isDtlb: Boolean) extends TlbModule with HasCSRConst{
   val entry = Reg(Vec(TlbEntrySize, new TlbEntry))
   val g = VecInit(entry.map(_.perm.g)).asUInt // TODO: need check if reverse is needed
 
+  /**
+    * PTW refill
+    */
+  val refill = ptw.resp.fire()
+  val randIdx = LFSR64()(log2Up(TlbEntrySize)-1,0)
+  val priorIdx = PriorityEncoder(~(v|pf))
+  val tlbfull = ParallelAND((v|pf).asBools)
+  val refillIdx = Mux(tlbfull, randIdx, priorIdx)
+  val refillIdxOH = UIntToOH(refillIdx)
+  when (refill) {
+    v := Mux(ptw.resp.bits.pf, v & ~refillIdxOH, v | refillIdxOH)
+    entry(refillIdx) := ptw.resp.bits.entry
+    XSDebug(p"Refill: idx:${refillIdx} entry:${ptw.resp.bits.entry}\n")
+  }
+
+  /**
+    * L1 TLB read
+    */
+  val tlb_read_mask = Mux(refill, refillIdxOH, 0.U(TlbEntrySize.W))
   def TLBRead(i: Int) = {
-    val entryHitVec = VecInit(entry.map(_.hit(reqAddr(i).vpn/*, satp.asid*/)))
+    val entryHitVec = (
+      if (isDtlb)
+        VecInit((tlb_read_mask.asBools zip entry).map{ case (r, e) => !r && e.hit(reqAddr(i).vpn/*, satp.asid*/)})
+      else
+        VecInit(entry.map(_.hit(reqAddr(i).vpn/*, satp.asid*/)))
+    )
 
     val reqAddrReg = if (isDtlb) RegNext(reqAddr(i)) else reqAddr(i)
     val cmdReg = if (isDtlb) RegNext(cmd(i)) else cmd(i)
@@ -364,25 +388,12 @@ class TLB(Width: Int, isDtlb: Boolean) extends TlbModule with HasCSRConst{
   val pfHitReset = ParallelOR(widthMap{i => Mux(resp(i).fire(), VecInit(pfHitVecVec(i)).asUInt, 0.U) })
   val pfHitRefill = ParallelOR(pfHitReset.asBools)
 
-  // refill
-  val refill = ptw.resp.fire()
-  val randIdx = LFSR64()(log2Up(TlbEntrySize)-1,0)
-  val priorIdx = PriorityEncoder(~(v|pf))
-  val tlbfull = ParallelAND((v|pf).asBools)
-  val refillIdx = Mux(tlbfull, randIdx, priorIdx)
-  val re2OH = UIntToOH(refillIdx)
-  when (refill) {
-    v := Mux(ptw.resp.bits.pf, v & ~re2OH, v | re2OH)
-    entry(refillIdx) := ptw.resp.bits.entry
-    XSDebug(p"Refill: idx:${refillIdx} entry:${ptw.resp.bits.entry}\n")
-  }
-
   // pf update
   when (refill) {
     when (pfHitRefill) {
-      pf := Mux(ptw.resp.bits.pf, pf | re2OH, pf & ~re2OH) & ~pfHitReset
+      pf := Mux(ptw.resp.bits.pf, pf | refillIdxOH, pf & ~refillIdxOH) & ~pfHitReset
     } .otherwise {
-      pf := Mux(ptw.resp.bits.pf, pf | re2OH, pf & ~re2OH)
+      pf := Mux(ptw.resp.bits.pf, pf | refillIdxOH, pf & ~refillIdxOH)
     }
   } .otherwise {
     when (pfHitRefill) {
@@ -390,7 +401,7 @@ class TLB(Width: Int, isDtlb: Boolean) extends TlbModule with HasCSRConst{
     }
   }
   when (PopCount(pf) > 10.U) { // when too much pf, just clear
-    pf := Mux(refill && ptw.resp.bits.pf, re2OH, 0.U)
+    pf := Mux(refill && ptw.resp.bits.pf, refillIdxOH, 0.U)
   }
 
   // sfence (flush)
diff --git a/src/main/scala/xiangshan/cache/icache.scala b/src/main/scala/xiangshan/cache/icache.scala
index f20097119cbf083f0af6433c197200a4792ce375..1f8a40cb7e78592b21eed09484905e63dfbe346b 100644
--- a/src/main/scala/xiangshan/cache/icache.scala
+++ b/src/main/scala/xiangshan/cache/icache.scala
@@ -311,7 +311,7 @@ class ICache extends ICacheModule
 
   //physical address < 0x80000000
   //TODO: May have bugs
-  s2_access_fault := (s2_tlb_resp.paddr(31,0) < accessBorder.U(31,0)) && s2_valid
+  s2_access_fault := (s2_tlb_resp.paddr < accessBorder.U) && s2_valid
 
   // SRAM(Meta and Data) read reseponse
   val metas = metaArray.io.readResp
diff --git a/src/main/scala/xiangshan/mem/pipeline/StoreUnit.scala b/src/main/scala/xiangshan/mem/pipeline/StoreUnit.scala
index 90b232ab4dd5fdb783a1108214b2374448837150..91da529e319dd172e6bcf9d9afbdb486fafcfe42 100644
--- a/src/main/scala/xiangshan/mem/pipeline/StoreUnit.scala
+++ b/src/main/scala/xiangshan/mem/pipeline/StoreUnit.scala
@@ -76,7 +76,7 @@ class StoreUnit_S1 extends XSModule {
 
   // get paddr from dtlb, check if rollback is needed
   // writeback store inst to lsq
-  io.lsq.valid := io.in.valid // TODO: && ! FP
+  io.lsq.valid := io.in.valid && !s1_tlb_miss// TODO: && ! FP
   io.lsq.bits := io.in.bits
   io.lsq.bits.paddr := s1_paddr
   io.lsq.bits.miss := false.B
diff --git a/src/test/csrc/compress.cpp b/src/test/csrc/compress.cpp
index a4649d21e70cc415492b7dc59e4d3231380e4996..75687f787452bb5b6d3f0c5036f719338108e77c 100644
--- a/src/test/csrc/compress.cpp
+++ b/src/test/csrc/compress.cpp
@@ -74,7 +74,9 @@ long readFromGz(void* ptr, const char *file_name, long buf_size, uint8_t load_ty
 
   while (curr_size < buf_size) {
     uint32_t bytes_read = gzread(compressed_mem, temp_page, chunk_size);
-    if (bytes_read == 0) { break; }
+    if (bytes_read == 0) {
+      break;
+    }
     assert(load_type != LOAD_RAM || bytes_read % sizeof(long) == 0);
     for (uint32_t x = 0; x < bytes_read / sizeof(long) + 1; x++) {
       if (*(temp_page + x) != 0) {
@@ -84,6 +86,11 @@ long readFromGz(void* ptr, const char *file_name, long buf_size, uint8_t load_ty
     }
     curr_size += bytes_read;
   }
+
+  if(gzread(compressed_mem, temp_page, chunk_size) > 0) {
+    printf("File size is larger than RAMSIZE!\n");
+    assert(0);
+  }
   printf("Read %lu bytes from gz stream in total\n", curr_size);
 
   delete [] temp_page;
@@ -93,4 +100,4 @@ long readFromGz(void* ptr, const char *file_name, long buf_size, uint8_t load_ty
     return -1;
   }
   return curr_size;
-}
\ No newline at end of file
+}
diff --git a/src/test/csrc/emu.cpp b/src/test/csrc/emu.cpp
index d5bb38519c1593e0713636d663cc97836d9debc9..234522ace8d691fb8cacf9d618f4d81655e20ed8 100644
--- a/src/test/csrc/emu.cpp
+++ b/src/test/csrc/emu.cpp
@@ -194,7 +194,11 @@ inline void Emulator::single_cycle() {
 #ifdef WITH_DRAMSIM3
   axi_channel axi;
   axi_copy_from_dut_ptr(dut_ptr, axi);
+  axi.aw.addr -= 0x80000000UL;
+  axi.ar.addr -= 0x80000000UL;
   dramsim3_helper(axi);
+  axi.aw.addr += 0x80000000UL;
+  axi.ar.addr += 0x80000000UL;
   axi_set_dut_ptr(dut_ptr, axi);
 #endif
 
@@ -322,6 +326,7 @@ uint64_t Emulator::execute(uint64_t max_cycle, uint64_t max_instr) {
   }
 
   if (Verilated::gotFinish()) {
+    difftest_display(dut_ptr->io_difftest_priviledgeMode);
     eprintf("The simulation stopped. There might be some assertion failed.\n");
     trapCode = STATE_ABORT;
   }