diff --git a/Kconfig b/Kconfig
index a21a63371..3a1324655 100644
--- a/Kconfig
+++ b/Kconfig
@@ -327,7 +327,6 @@ config RT_CHECK
   default y
 
 config PERF_OPT
-  depends on !SHARE
   bool "Performance optimization"
   default y
 
diff --git a/configs/riscv64-xs-ref_defconfig b/configs/riscv64-xs-ref_defconfig
index 858870241..8adee4ebe 100644
--- a/configs/riscv64-xs-ref_defconfig
+++ b/configs/riscv64-xs-ref_defconfig
@@ -25,7 +25,6 @@ CONFIG_RV_DEBUG=y
 CONFIG_RV_PMP_CSR=y
 CONFIG_RV_PMP_NUM=16
 CONFIG_PMP_GRANULARITY=12
-CONFIG_RV_PMP_CHECK=y
 CONFIG_RV_SVINVAL=y
 CONFIG_MISA_UNCHANGEABLE=y
 CONFIG_XTVEC_VECTORED_MODE=y
@@ -52,7 +51,7 @@ CONFIG_CC="gcc"
 CONFIG_CC_O2=y
 # CONFIG_CC_O3 is not set
 CONFIG_CC_OPT="-O2"
-# CONFIG_CC_LTO is not set
+CONFIG_CC_LTO=y
 # CONFIG_CC_DEBUG is not set
 # CONFIG_CC_ASAN is not set
 # end of Build Options
@@ -61,6 +60,7 @@ CONFIG_CC_OPT="-O2"
 # Testing and Debugging
 #
 # CONFIG_DEBUG is not set
+# CONFIG_DIFFTEST is not set
 CONFIG_DIFFTEST_REF_PATH="none"
 CONFIG_DIFFTEST_REF_NAME="none"
 # CONFIG_DETERMINISTIC is not set
@@ -78,26 +78,45 @@ CONFIG_DIFFTEST_REF_NAME="none"
 CONFIG_MBASE=0x80000000
 CONFIG_MSIZE=0x200000000
 CONFIG_PADDRBITS=36
-CONFIG_STORE_LOG=y
-CONFIG_STORE_LOG_SIZE=1024
+# CONFIG_STORE_LOG is not set
 # CONFIG_BR_LOG is not set
 CONFIG_BBL_OFFSET_WITH_CPT=0xa0000
-CONFIG_RESET_FROM_MMIO=y
+# CONFIG_RESET_FROM_MMIO is not set
 CONFIG_PC_RESET_OFFSET=0x0
-CONFIG_MMIO_RESET_VECTOR=0x10000000
 CONFIG_USE_MMAP=y
 # CONFIG_MEM_RANDOM is not set
 # CONFIG_MEM_COMPRESS is not set
 # end of Memory Configuration
 
 CONFIG_DEVICE=y
-# CONFIG_HAS_UARTLITE is not set
-# CONFIG_HAS_VGA is not set
-CONFIG_HAS_FLASH=y
-CONFIG_FLASH_PRESET_CONTENT="0x0010029b,0x01f29293,0x00028067"
-CONFIG_FLASH_START_ADDR=0x10000000
-CONFIG_FLASH_SIZE=0x100000
-CONFIG_FLASH_IMG_PATH=""
+CONFIG_HAS_PORT_IO=y
+# CONFIG_HAS_SERIAL is not set
+CONFIG_HAS_UARTLITE=y
+# CONFIG_HAS_UART_SNPS is not set
+# CONFIG_HAS_PLIC is not set
+CONFIG_UARTLITE_PORT=0x3f8
+CONFIG_UARTLITE_MMIO=0x40600000
+# CONFIG_UARTLITE_INPUT_FIFO is not set
+# CONFIG_UARTLITE_ASSERT_FOUR is not set
+CONFIG_HAS_TIMER=y
+CONFIG_RTC_PORT=0x48
+CONFIG_RTC_MMIO=0xa1000048
+CONFIG_HAS_KEYBOARD=y
+CONFIG_I8042_DATA_PORT=0x60
+CONFIG_I8042_DATA_MMIO=0xa1000060
+CONFIG_HAS_VGA=y
+CONFIG_FB_ADDR=0x50000000
+CONFIG_VGA_CTL_PORT=0x100
+CONFIG_VGA_CTL_MMIO=0x40001000
+# CONFIG_VGA_SHOW_SCREEN is not set
+CONFIG_VGA_SIZE_400x300=y
+# CONFIG_VGA_SIZE_800x600 is not set
+# CONFIG_HAS_AUDIO is not set
+# CONFIG_HAS_DISK is not set
+CONFIG_HAS_SDCARD=y
+CONFIG_SDCARD_CTL_MMIO=0x40002000
+CONFIG_SDCARD_IMG_PATH=""
+# CONFIG_HAS_FLASH is not set
 # CONFIG_FPU_HOST is not set
 CONFIG_FPU_SOFT=y
 # CONFIG_FPU_NONE is not set
@@ -109,12 +128,6 @@ CONFIG_AC_SOFT=y
 # Processor difftest reference config
 #
 CONFIG_SHARE=y
-CONFIG_DIFFTEST_STORE_COMMIT=y
-# CONFIG_DIFFTEST_STORE_COMMIT_AMO is not set
-CONFIG_GUIDED_EXEC=y
-CONFIG_QUERY_REF=y
-CONFIG_LARGE_COPY=y
-# CONFIG_PANIC_ON_UNIMP_CSR is not set
 # end of Processor difftest reference config
 
 #
@@ -122,7 +135,12 @@ CONFIG_LARGE_COPY=y
 #
 CONFIG_TIMER_GETTIMEOFDAY=y
 # CONFIG_TIMER_CLOCK_GETTIME is not set
-# CONFIG_REPORT_ILLEGAL_INSTR is not set
+CONFIG_REPORT_ILLEGAL_INSTR=y
 CONFIG_RT_CHECK=y
+CONFIG_PERF_OPT=y
+CONFIG_TCACHE_SIZE=8192
+CONFIG_BB_LIST_SIZE=1024
+CONFIG_BB_POOL_SIZE=1024
+# CONFIG_DISABLE_INSTR_CNT is not set
 CONFIG_ENABLE_INSTR_CNT=y
 # end of Miscellaneous
diff --git a/include/cpu/cpu.h b/include/cpu/cpu.h
index 7013bb903..c4b6476f3 100644
--- a/include/cpu/cpu.h
+++ b/include/cpu/cpu.h
@@ -27,7 +27,7 @@ enum {
   NEMU_EXEC_EXCEPTION
 };
 
-void cpu_exec(uint64_t n);
+int cpu_exec(uint64_t n);
 __attribute__((noreturn)) void longjmp_exec(int cause);
 __attribute__((noreturn)) void longjmp_exception(int ex_cause);
 
diff --git a/src/cpu/cpu-exec.c b/src/cpu/cpu-exec.c
index fac4ab1ed..6c87724b2 100644
--- a/src/cpu/cpu-exec.c
+++ b/src/cpu/cpu-exec.c
@@ -589,20 +589,23 @@ static void update_global() {
 #endif
 
 /* Simulate how the CPU works. */
-void cpu_exec(uint64_t n) {
+int cpu_exec(uint64_t n) {
 #ifndef CONFIG_LIGHTQS
   IFDEF(CONFIG_SHARE, assert(n <= 1));
 #endif
   g_print_step = (n < MAX_INSTR_TO_PRINT);
   switch (nemu_state.state) {
   case NEMU_END:
-  case NEMU_ABORT:
     printf("Program execution has ended. To restart the program, exit NEMU and "
            "run again.\n");
+    return 0;
+  case NEMU_ABORT:
+    printf("Program execution has aborted. To restart the program, exit NEMU and "
+           "run again.\n");
+    return -1;
 #ifdef CONFIG_BR_LOG
     printf("debug: bridx = %ld\n", br_count);
 #endif // CONFIG_BR_LOG
-    return;
   default:
     nemu_state.state = NEMU_RUNNING;
     Loge("Setting NEMU state to RUNNING");
@@ -617,7 +620,9 @@ void cpu_exec(uint64_t n) {
     n_remain -= prev_s->idx_in_bb - 1;
     // Here is exception handle
 #ifdef CONFIG_PERF_OPT
+    #ifndef CONFIG_SHARE
     update_global();
+    #endif
 #endif
     Loge("After update_global, n_remain: %i, n_remain_total: %li", n_remain,
          n_remain_total);
@@ -726,4 +731,13 @@ void cpu_exec(uint64_t n) {
     break;
 #endif
   }
+  if(cpu.pc == 0) {
+    printf("ERROR: current pc change to 0x%016lx\n", cpu.pc);
+    assert(0);
+  }
+  #ifdef CONFIG_PERF_OPT
+    return g_nr_guest_instr;
+  #else 
+    return n;
+  #endif
 }
diff --git a/src/device/io/mmio.c b/src/device/io/mmio.c
index 26444279e..42a622c05 100644
--- a/src/device/io/mmio.c
+++ b/src/device/io/mmio.c
@@ -35,9 +35,9 @@ void add_mmio_map(const char *name, paddr_t addr, void *space, uint32_t len, io_
   assert(nr_map < NR_MAP);
   maps[nr_map] = (IOMap){ .name = name, .low = addr, .high = addr + len - 1,
     .space = space, .callback = callback };
-  // Log("Add mmio map '%s' at [" FMT_PADDR ", " FMT_PADDR "]",
-  //     maps[nr_map].name, maps[nr_map].low, maps[nr_map].high);
-  // fflush(stdout);
+  Log("Add mmio map '%s' at [" FMT_PADDR ", " FMT_PADDR "]",
+      maps[nr_map].name, maps[nr_map].low, maps[nr_map].high);
+  fflush(stdout);
 
   nr_map ++;
 }
diff --git a/src/device/serial.c b/src/device/serial.c
index 5bc537159..60a069255 100644
--- a/src/device/serial.c
+++ b/src/device/serial.c
@@ -141,7 +141,7 @@ void init_serial() {
   // to avoid unused-function warning
   (void)serial_io_handler;
 #else
-  printf("init_serial\n");
+  //printf("init_serial\n");
   serial_base = new_space(8);
   add_pio_map ("serial", CONFIG_SERIAL_PORT, serial_base, 8, serial_io_handler);
   add_mmio_map("serial", CONFIG_SERIAL_MMIO, serial_base, 8, serial_io_handler);
diff --git a/src/isa/riscv64/init.c b/src/isa/riscv64/init.c
index 197042504..2ca6bed81 100644
--- a/src/isa/riscv64/init.c
+++ b/src/isa/riscv64/init.c
@@ -33,11 +33,10 @@ void init_csr();
 void init_trigger();
 #endif
 
-#if !defined(CONFIG_SHARE) || defined(CONFIG_LIGHTQS)
-void init_clint();
-#endif
 void init_device();
 
+void init_clint();
+
 void init_isa() {
   // NEMU has some cached states and some static variables in the source code.
   // They are assumed to have initialized states every time when the dynamic lib is loaded.
@@ -123,17 +122,13 @@ void init_isa() {
   }
 #endif
 
-  #if defined(CONFIG_LIGHTQS) || !defined(CONFIG_SHARE)
   init_clint();
-  #endif
 
   if (!is_second_call) {
     IFDEF(CONFIG_SHARE, init_device());
   }
 
-#ifndef CONFIG_SHARE
   Log("NEMU will start from pc 0x%lx", cpu.pc);
-#endif
 
   csr_prepare();
 
diff --git a/src/memory/paddr.c b/src/memory/paddr.c
index 8f454fcea..444790813 100644
--- a/src/memory/paddr.c
+++ b/src/memory/paddr.c
@@ -14,11 +14,13 @@
 * See the Mulan PSL v2 for more details.
 ***************************************************************************************/
 
+#include <stdio.h>
 #include <isa.h>
 #include <memory/host.h>
 #include <memory/paddr.h>
 #include <memory/sparseram.h>
 #include <device/mmio.h>
+#include <stdint.h>
 #include <stdlib.h>
 #include <time.h>
 #include <cpu/cpu.h>
@@ -84,6 +86,27 @@ void * get_sparsemm(){
 uint8_t* guest_to_host(paddr_t paddr) { return paddr + HOST_PMEM_OFFSET; }
 paddr_t host_to_guest(uint8_t *haddr) { return haddr - HOST_PMEM_OFFSET; }
 
+
+typedef uint64_t (*read_ptr)(uint64_t, int);
+typedef void (*write_ptr)(uint64_t, int, uint64_t);
+
+read_ptr gem5_ifetch;
+read_ptr gem5_read;
+write_ptr gem5_write;
+
+void set_gi(read_ptr func)
+{
+  gem5_ifetch = func;
+}
+void set_gr(read_ptr func)
+{
+  gem5_read = func;
+}
+void set_gw(write_ptr func)
+{
+  gem5_write = func;
+}
+
 static inline word_t pmem_read(paddr_t addr, int len) {
 #ifdef CONFIG_MEMORY_REGION_ANALYSIS
   analysis_memory_commit(addr);
@@ -173,15 +196,26 @@ word_t paddr_read(paddr_t addr, int len, int type, int mode, vaddr_t vaddr) {
     return 0;
   }
 #ifndef CONFIG_SHARE
-  if (likely(in_pmem(addr))) return pmem_read(addr, len);
+  if (likely(in_pmem(addr))) {
+    uint64_t data = pmem_read(addr, len);
+    return data;
+  }
   else {
-    if (likely(is_in_mmio(addr))) return mmio_read(addr, len);
+    if (likely(is_in_mmio(addr))) {
+      uint64_t data = mmio_read(addr, len);
+      return data;
+    }
     else raise_read_access_fault(type, vaddr);
     return 0;
   }
 #else
   if (likely(in_pmem(addr))) {
-    uint64_t rdata = pmem_read(addr, len);
+    uint64_t rdata;
+    if(type == MEM_TYPE_IFETCH || type == MEM_TYPE_IFETCH_READ){
+      rdata = gem5_ifetch(addr, len);
+    }else{
+      rdata = gem5_read(addr, len);
+    }
     if (dynamic_config.debug_difftest) {
       fprintf(stderr, "[NEMU] paddr read addr:" FMT_PADDR ", data: %016lx, len:%d, type:%d, mode:%d\n",
         addr, rdata, len, type, mode);
@@ -189,12 +223,15 @@ word_t paddr_read(paddr_t addr, int len, int type, int mode, vaddr_t vaddr) {
     return rdata;
   }
   else {
-#ifdef CONFIG_HAS_FLASH
-    if (likely(is_in_mmio(addr))) return mmio_read(addr, len);
-#endif
+    if (likely(is_in_mmio(addr))) 
+    {
+      uint64_t data = gem5_read(addr, len);
+      return data;
+    }
     if(dynamic_config.ignore_illegal_mem_access)
       return 0;
     printf("ERROR: invalid mem read from paddr " FMT_PADDR ", NEMU raise access exception\n", addr);
+    assert(0);
     raise_read_access_fault(type, vaddr);
   }
   return 0;
@@ -273,9 +310,13 @@ void paddr_write(paddr_t addr, int len, word_t data, int mode, vaddr_t vaddr) {
     return ;
   }
 #ifndef CONFIG_SHARE
-  if (likely(in_pmem(addr))) pmem_write(addr, len, data);
+  if (likely(in_pmem(addr))) {
+    pmem_write(addr, len, data);
+  }
   else {
-    if (likely(is_in_mmio(addr))) mmio_write(addr, len, data);
+    if (likely(is_in_mmio(addr))){
+      mmio_write(addr, len, data);
+    } 
     else raise_access_fault(EX_SAF, vaddr);
   }
 #else
@@ -287,13 +328,16 @@ void paddr_write(paddr_t addr, int len, word_t data, int mode, vaddr_t vaddr) {
       fprintf(stderr, "[NEMU] paddr write addr:" FMT_PADDR ", data:%016lx, len:%d, mode:%d\n",
         addr, data, len, mode);
     }
-    return pmem_write(addr, len, data);
+    gem5_write(addr, len, data);
   } else {
-    if (likely(is_in_mmio(addr))) mmio_write(addr, len, data);
+    if (likely(is_in_mmio(addr))) {
+      gem5_write(addr, len, data);
+    }
     else {
       if(dynamic_config.ignore_illegal_mem_access)
         return;
       printf("ERROR: invalid mem write to paddr " FMT_PADDR ", NEMU raise access exception\n", addr);
+      assert(0);
       raise_access_fault(EX_SAF, vaddr);
       return;
     }
diff --git a/src/memory/vaddr.c b/src/memory/vaddr.c
index e23522e06..0bd783768 100644
--- a/src/memory/vaddr.c
+++ b/src/memory/vaddr.c
@@ -18,9 +18,9 @@
 //#include <profiling/betapoint-ext.h>
 #include <profiling/profiling_control.h>
 
-#ifdef CONFIG_PERF_OPT
-#define ENABLE_HOSTTLB 1
-#endif
+// #ifdef CONFIG_PERF_OPT
+// #define ENABLE_HOSTTLB 1
+// #endif
 
 #include <memory/paddr.h>
 #include <memory/vaddr.h>