diff --git a/chisel/playground/src/cache/mmu/ITlbL1.scala b/chisel/playground/src/cache/mmu/ITlbL1.scala
index 546aeee..c2effbb 100644
--- a/chisel/playground/src/cache/mmu/ITlbL1.scala
+++ b/chisel/playground/src/cache/mmu/ITlbL1.scala
@@ -17,8 +17,8 @@ class ITlbL1 extends Module {
   io.cache.uncached       := AddressSpace.isMMIO(io.addr)
   io.cache.translation_ok := true.B
   io.cache.hit            := true.B
-  io.cache.ptag            := io.addr(PADDR_WID - 1, cacheConfig.offsetWidth + cacheConfig.indexWidth)
-  io.cache.paddr             := Cat(io.cache.ptag, io.addr(cacheConfig.offsetWidth + cacheConfig.indexWidth - 1, 0))
+  io.cache.ptag           := io.addr(PADDR_WID - 1, cacheConfig.offsetWidth + cacheConfig.indexWidth)
+  io.cache.paddr          := Cat(io.cache.ptag, io.addr(cacheConfig.offsetWidth + cacheConfig.indexWidth - 1, 0))
 
   println("----------------------------------------")
   println("ITlbL1")
diff --git a/chisel/playground/src/pipeline/decoder/Issue.scala b/chisel/playground/src/pipeline/decoder/Issue.scala
index 8c17cb0..0c02f22 100644
--- a/chisel/playground/src/pipeline/decoder/Issue.scala
+++ b/chisel/playground/src/pipeline/decoder/Issue.scala
@@ -7,7 +7,7 @@ import cpu.defines.Const._
 import cpu.defines.Instructions._
 import cpu.CpuConfig
 
-class Issue(implicit val config: CpuConfig) extends Module {
+class Issue(implicit val config: CpuConfig) extends Module with HasCSRConst {
   val io = IO(new Bundle {
     // 输入
     val allow_to_go = Input(Bool())
@@ -51,19 +51,26 @@ class Issue(implicit val config: CpuConfig) extends Module {
           inst0.reg_waddr === inst1.src2_raddr && inst1.src2_ren)
     val data_conflict = raw_reg || load_stall
 
-    // 指令有出现bru指令
+    // bru指令只能在inst0执行
     val is_bru = VecInit(
       inst0.fusel === FuType.bru,
       inst1.fusel === FuType.bru
     ).asUInt.orR
 
+    // mou指令会导致流水线清空
     val is_mou = VecInit(
       inst0.fusel === FuType.mou,
       inst1.fusel === FuType.mou
     ).asUInt.orR
 
+    // 写satp指令会导致流水线清空
+    val write_satp = VecInit(
+      inst0.fusel === FuType.csr && inst0.op =/= CSROpType.jmp && inst0.inst(31, 20) === Satp.U,
+      inst1.fusel === FuType.csr && inst1.op =/= CSROpType.jmp && inst1.inst(31, 20) === Satp.U
+    ).asUInt.orR
+
     // 下面的情况只进行单发射
-    val single_issue = is_mou || is_bru
+    val single_issue = is_mou || is_bru || write_satp
 
     // 指令1是否允许执行
     io.inst1.allow_to_go :=
diff --git a/chisel/playground/src/pipeline/execute/ExecuteUnit.scala b/chisel/playground/src/pipeline/execute/ExecuteUnit.scala
index 88b174e..d2102ff 100644
--- a/chisel/playground/src/pipeline/execute/ExecuteUnit.scala
+++ b/chisel/playground/src/pipeline/execute/ExecuteUnit.scala
@@ -67,6 +67,13 @@ class ExecuteUnit(implicit val config: CpuConfig) extends Module {
   io.ctrl.flush             := io.fetchUnit.flush
 
   io.csr.in.valid := is_csr.asUInt.orR
+  io.csr.in.pc := MuxCase(
+    0.U,
+    Seq(
+      is_csr(0) -> io.executeStage.inst0.pc,
+      is_csr(1) -> io.executeStage.inst1.pc
+    )
+  )
   io.csr.in.info := MuxCase(
     0.U.asTypeOf(new InstInfo()),
     Seq(
@@ -116,8 +123,8 @@ class ExecuteUnit(implicit val config: CpuConfig) extends Module {
   io.bpu.branch_inst      := io.executeStage.inst0.jb_info.branch_inst
 
   io.fetchUnit.flush := valid(0) && io.ctrl.allow_to_go &&
-    fu.branch.flush
-  io.fetchUnit.target := fu.branch.target
+    (fu.branch.flush || io.csr.out.flush)
+  io.fetchUnit.target := Mux(io.csr.out.flush, io.csr.out.target, fu.branch.target)
 
   io.ctrl.fu_stall := fu.stall_req
 
diff --git a/chisel/playground/src/pipeline/execute/fu/Csr.scala b/chisel/playground/src/pipeline/execute/fu/Csr.scala
index 6f176c3..6eb9172 100644
--- a/chisel/playground/src/pipeline/execute/fu/Csr.scala
+++ b/chisel/playground/src/pipeline/execute/fu/Csr.scala
@@ -18,8 +18,8 @@ class CsrMemoryUnit(implicit val config: CpuConfig) extends Bundle {
     val set_lr_addr = UInt(DATA_ADDR_WID.W)
   })
   val out = Output(new Bundle {
-    val flush    = Bool()
-    val flush_pc = UInt(XLEN.W)
+    val flush  = Bool()
+    val target = UInt(XLEN.W)
 
     val lr      = Bool()
     val lr_addr = UInt(DATA_ADDR_WID.W)
@@ -29,13 +29,16 @@ class CsrMemoryUnit(implicit val config: CpuConfig) extends Bundle {
 class CsrExecuteUnit(implicit val config: CpuConfig) extends Bundle {
   val in = Input(new Bundle {
     val valid    = Bool()
+    val pc       = UInt(XLEN.W)
     val info     = new InstInfo()
     val src_info = new SrcInfo()
     val ex       = new ExceptionInfo()
   })
   val out = Output(new Bundle {
-    val rdata = UInt(XLEN.W)
-    val ex    = new ExceptionInfo()
+    val rdata  = UInt(XLEN.W)
+    val ex     = new ExceptionInfo()
+    val flush  = Bool()
+    val target = UInt(XLEN.W)
   })
 }
 
@@ -283,6 +286,7 @@ class Csr(implicit val config: CpuConfig) extends Module with HasCSRConst {
 
   MaskedRegMap.generate(mapping, addr, rdata, wen, wdata)
   val illegal_addr = MaskedRegMap.isIllegalAddr(mapping, addr)
+  val write_satp   = (addr === Satp.U) && write
   // Fix Mip/Sip write
   val fixMapping = Map(
     MaskedRegMap(Mip, mipReg.asUInt, mipFixMask),
@@ -400,23 +404,13 @@ class Csr(implicit val config: CpuConfig) extends Module with HasCSRConst {
     ret_target       := sepc(VADDR_WID - 1, 0)
   }
 
-  //TODO: add mode U
-  // when (isUret) {
-  //   val mstatusOld = WireInit(mstatus.asTypeOf(new Mstatus))
-  //   val mstatusNew = WireInit(mstatus.asTypeOf(new Mstatus))
-  //   // mstatusNew.mpp.m := ModeU
-  //   mstatusNew.ie.u := mstatusOld.pie.u
-  //   mode := ModeU
-  //   mstatusNew.pie.u := true.B
-  //   mstatus := mstatusNew.asUInt
-  //   ret_target := uepc(VADDR_WID-1, 0)
-  // }
-
   io.decoderUnit.mode   := mode
   io.executeUnit.out.ex := io.executeUnit.in.ex
   io.executeUnit.out.ex.exception(illegalInstr) :=
     (illegal_addr || illegal_access) && write | io.executeUnit.in.ex.exception(illegalInstr)
-  io.executeUnit.out.rdata   := rdata
-  io.memoryUnit.out.flush    := has_exc_int || ret
-  io.memoryUnit.out.flush_pc := Mux(has_exc_int, trap_target, ret_target)
+  io.executeUnit.out.rdata  := rdata
+  io.executeUnit.out.flush  := write_satp
+  io.executeUnit.out.target := io.executeUnit.in.pc + 4.U
+  io.memoryUnit.out.flush   := has_exc_int || ret
+  io.memoryUnit.out.target  := Mux(has_exc_int, trap_target, ret_target)
 }
diff --git a/chisel/playground/src/pipeline/memory/MemoryUnit.scala b/chisel/playground/src/pipeline/memory/MemoryUnit.scala
index 23832db..64adeac 100644
--- a/chisel/playground/src/pipeline/memory/MemoryUnit.scala
+++ b/chisel/playground/src/pipeline/memory/MemoryUnit.scala
@@ -129,5 +129,5 @@ class MemoryUnit(implicit val config: CpuConfig) extends Module {
   io.ctrl.complete_single_request := lsu.memoryUnit.out.complete_single_request
 
   io.fetchUnit.flush  := io.ctrl.allow_to_go && (io.csr.out.flush || mou.out.flush)
-  io.fetchUnit.target := Mux(io.csr.out.flush, io.csr.out.flush_pc, mou.out.target)
+  io.fetchUnit.target := Mux(io.csr.out.flush, io.csr.out.target, mou.out.target)
 }