diff --git a/difftest/dpi_t1rocketemu/src/interconnect.rs b/difftest/dpi_t1rocketemu/src/interconnect.rs
index ee65650f2..56d937764 100644
--- a/difftest/dpi_t1rocketemu/src/interconnect.rs
+++ b/difftest/dpi_t1rocketemu/src/interconnect.rs
@@ -194,7 +194,7 @@ impl AddressSpace {
 
 /// Memory map:
 /// - 0x0400_0000 - 0x0600_0000 : framebuffer
-/// - 0x4000_0000 - 0x4000_1000 : simctrl
+/// - 0x1000_0000 - 0x1000_1000 : simctrl
 /// - 0x2000_0000 - 0xc000_0000 : ddr
 /// - 0xc000_0000 - 0xc040_0000 : sram
 /// TODO: simctrl is inside ddr, move it elsewhere
@@ -204,7 +204,7 @@ pub fn create_emu_addrspace() -> (AddressSpace, ExitFlagRef) {
   const SRAM_BASE: u32 = 0xc000_0000;
   const SRAM_SIZE: u32 = 0x0040_0000;
 
-  const SIMCTRL_BASE: u32 = 0x4000_0000;
+  const SIMCTRL_BASE: u32 = 0x1000_0000;
   const SIMCTRL_SIZE: u32 = 0x0000_1000; // one page
   const DISPLAY_BASE: u32 = 0x0400_0000;
   const DISPLAY_SIZE: u32 = 0x0200_0000;
@@ -212,10 +212,10 @@ pub fn create_emu_addrspace() -> (AddressSpace, ExitFlagRef) {
   let exit_flag = ExitFlagRef::new();
 
   let devices = vec![
-    SimCtrl::new(exit_flag.clone()).with_addr(SIMCTRL_BASE, SIMCTRL_SIZE),
     RegularMemory::with_size(DDR_SIZE).with_addr(DDR_BASE, DDR_SIZE),
     RegularMemory::with_size(SRAM_SIZE).with_addr(SRAM_BASE, SRAM_SIZE),
     FrameBuffer::new().with_addr(DISPLAY_BASE, DISPLAY_SIZE),
+    SimCtrl::new(exit_flag.clone()).with_addr(SIMCTRL_BASE, SIMCTRL_SIZE),
   ];
   (AddressSpace { devices }, exit_flag)
 }
diff --git a/difftest/spike_rs/src/spike_event.rs b/difftest/spike_rs/src/spike_event.rs
index e05039bea..b36cd1c5c 100644
--- a/difftest/spike_rs/src/spike_event.rs
+++ b/difftest/spike_rs/src/spike_event.rs
@@ -460,8 +460,8 @@ impl SpikeEvent {
       });
       trace!("SpikeMemWrite: addr={addr:x}, value={value:x}, size={size}");
 
-      if addr == 0x4000_0000 && value == 0xdead_beef {
-        trace!("SpikeExit: exit by writing 0xdeadbeef to 0x40000000");
+      if addr == 0x1000_0000 && value == 0xdead_beef {
+        trace!("SpikeExit: exit by writing 0xdeadbeef to 0x10000000");
         self.is_exit = true;
 
         return;
diff --git a/tests/codegen/include/riscv_test.h b/tests/codegen/include/riscv_test.h
index cb0d21863..05ae7111d 100644
--- a/tests/codegen/include/riscv_test.h
+++ b/tests/codegen/include/riscv_test.h
@@ -157,7 +157,7 @@
 
 // Write our custom CSR msimend to exit simulation.
 #define RVTEST_CODE_END                                                        \
-  li x1, 0x40000000;                                                           \
+  li x1, 0x10000000;                                                           \
   li x2, 0xdeadbeef;                                                           \
   sw x2, 0(x1);                                                                \
   j .;
diff --git a/tests/emurt/emurt.c b/tests/emurt/emurt.c
index 01fc670ef..04fd1b416 100644
--- a/tests/emurt/emurt.c
+++ b/tests/emurt/emurt.c
@@ -54,7 +54,7 @@ int _write(int file, char* ptr, int len) {
 }
 
 void _exit(int code) {
-  __asm__("li x1, 0x40000000");
+  __asm__("li x1, 0x10000000");
   __asm__("li x2, 0xdeadbeef");
   __asm__("sw x2, 0(x1)");
   __asm__("j .");
diff --git a/tests/riscv-test-env/p/riscv_test.h b/tests/riscv-test-env/p/riscv_test.h
index 3bab9ce13..00dc5b95a 100644
--- a/tests/riscv-test-env/p/riscv_test.h
+++ b/tests/riscv-test-env/p/riscv_test.h
@@ -237,7 +237,7 @@ reset_vector:                                                           \
 // End Macro
 //-----------------------------------------------------------------------
 
-#define EXIT_POS 0x40000000;
+#define EXIT_POS 0x10000000;
 #define EXIT_CODE 0xdeadbeef;
 #define RVTEST_CODE_END                                                 \
         li x1, EXIT_POS;                                                \
diff --git a/tests/t1_main.S b/tests/t1_main.S
index 1fa081576..18151c863 100644
--- a/tests/t1_main.S
+++ b/tests/t1_main.S
@@ -10,7 +10,7 @@ _start:
     call test
 
     // exit
-    li x1, 0x40000000
+    li x1, 0x10000000
     li x2, 0xdeadbeef
     sw x2, 0(x1)
     j .