diff --git a/nemu/configs/tmp_defconfig b/nemu/configs/tmp_defconfig
new file mode 100644
index 0000000..3cb29f8
--- /dev/null
+++ b/nemu/configs/tmp_defconfig
@@ -0,0 +1,3 @@
+# CONFIG_ITRACE is not set
+CONFIG_PMEM_MALLOC=y
+CONFIG_DEVICE=y
diff --git a/nemu/src/device/audio.c b/nemu/src/device/audio.c
index b03b731..d1350b6 100644
--- a/nemu/src/device/audio.c
+++ b/nemu/src/device/audio.c
@@ -30,13 +30,15 @@ enum {
 static uint8_t *sbuf = NULL;
 static uint32_t *audio_base = NULL;
 static uint32_t pos_read = 0;
+static uint32_t audio_count = 0;
 
 #define MIN(a, b) ((a) < (b) ? (a) : (b))
 
 static void audio_callback(void *userdata, uint8_t *stream, int len) {
-  uint32_t count = audio_base[reg_count];
+  SDL_LockAudio();
+  uint32_t count = audio_count;
   uint32_t read_cnt = MIN(count, len);
-  uint32_t to_end_cnt = audio_base[reg_sbuf_size] - pos_read;
+  uint32_t to_end_cnt = CONFIG_SB_SIZE - pos_read;
   int32_t out_bound_cnt = read_cnt - to_end_cnt;
   // memset(stream, 0, len);
   if (out_bound_cnt > 0) {
@@ -46,9 +48,10 @@ static void audio_callback(void *userdata, uint8_t *stream, int len) {
     memcpy(stream, sbuf + pos_read, read_cnt);
   }
   pos_read += read_cnt;
-  pos_read %= audio_base[reg_sbuf_size];
+  pos_read %= CONFIG_SB_SIZE;
   if (len > read_cnt) memset(stream + read_cnt, 0, len - read_cnt);
-  audio_base[reg_count] -= read_cnt;
+  audio_count -= read_cnt;
+  SDL_UnlockAudio();
 }
 
 static inline void init_audio_dev() {
@@ -82,7 +85,11 @@ static void audio_io_handler(uint32_t offset, int len, bool is_write) {
       }
       break;
     case reg_count:
+      SDL_LockAudio();
       // TODO: must be add a lock here
+      if (is_write) audio_count = audio_base[reg_count];
+      else audio_base[reg_count] = audio_count;
+      SDL_UnlockAudio();
       break;
     default:
       assert(0);