diff --git a/benchmarks/coremark/riscv64-baremetal/core_portme.h b/benchmarks/coremark/riscv64-baremetal/core_portme.h
index ce88f7239..4f5efc1d8 100755
--- a/benchmarks/coremark/riscv64-baremetal/core_portme.h
+++ b/benchmarks/coremark/riscv64-baremetal/core_portme.h
@@ -109,7 +109,8 @@ typedef unsigned short ee_u16;
 typedef signed int ee_s32;
 typedef double ee_f32;
 typedef unsigned char ee_u8;
-typedef unsigned int ee_u32;
+//typedef unsigned int ee_u32;
+typedef signed int ee_u32; // replaced with signed to improve performance per https://github.com/sifive/benchmark-coremark/blob/master/linux64/core_portme.h#L102
 #if (XLEN==64) 
 	typedef unsigned long long ee_ptr_int;
 #else
diff --git a/sim/verilate b/sim/verilate
index 8f4397dcb..b1bb7f2fa 100755
--- a/sim/verilate
+++ b/sim/verilate
@@ -1,7 +1,8 @@
 #!/bin/bash
 # simulate with Verilator
 
-# verilator --timescale "1ns/1ns" --timing --binary -GTEST="arch64i" --top-module testbench "-I../config/shared" "-I../config/rv64gc" ../src/cvw.sv ../testbench/testbench.sv ../testbench/common/*.sv ../src/*/*.sv ../src/*/*/*.sv --relative-includes
+# verilator -CFLAGS -DVL_DEBUG -CFLAGS -D_GLIBCXX_DEBUG -CFLAGS -ggdb -LDFLAGS -ggdb -CFLAGS -fsanitize=address,undefined -LDFLAGS -fsanitize=address,undefined --timescale "1ns/1ns" --timing --binary --top-module testbench "-I../config/shared" "-I../config/rv64gc" ../src/cvw.sv ../testbench/testbench.sv ../testbench/common/*.sv ../src/*/*.sv ../src/*/*/*.sv --relative-includes
+# verilator -GTEST="arch64i" --timescale "1ns/1ns" --timing --binary --top-module testbench "-I../config/shared" "-I../config/rv64gc" ../src/cvw.sv ../testbench/testbench.sv ../testbench/common/*.sv ../src/*/*.sv ../src/*/*/*.sv --relative-includes
 
 export PATH=$PATH:/usr/local/bin/
 verilator=`which verilator`
diff --git a/src/mmu/tlb/tlbcontrol.sv b/src/mmu/tlb/tlbcontrol.sv
index dced20d29..06df51935 100644
--- a/src/mmu/tlb/tlbcontrol.sv
+++ b/src/mmu/tlb/tlbcontrol.sv
@@ -97,7 +97,7 @@ module tlbcontrol import cvw::*;  #(parameter cvw_t P, ITLB = 0) (
     assign PreUpdateDA = ~PTE_A;
     assign InvalidAccess = ~PTE_X;
  end else begin:dtlb // Data TLB fault checking
-    logic InvalidRead, InvalidWrite;
+    logic InvalidRead, InvalidWrite, ReservtedEncoding;
     logic InvalidCBOM, InvalidCBOZ;
 
     // User mode may only load/store from user mode pages, and supervisor mode
@@ -108,12 +108,12 @@ module tlbcontrol import cvw::*;  #(parameter cvw_t P, ITLB = 0) (
     // (and executable pages are not readable) or when the page is neither
     // readable nor executable (and executable pages are readable).
     assign InvalidRead = ReadAccess & ~PTE_R & (~STATUS_MXR | ~PTE_X);
-    // Check for write error. Writes are invalid when the page's write bit is
-    // low.
+    // Check for write error. Writes are invalid when the page's write bit is 0.
     assign InvalidWrite = WriteAccess & ~PTE_W;
-    assign InvalidCBOM = (|CMOpM[2:0]) & (~PTE_W & (~PTE_R & (~STATUS_MXR | ~PTE_X)));
+    assign InvalidCBOM = (|CMOpM[2:0]) & (~PTE_R & (~STATUS_MXR | ~PTE_X));
     assign InvalidCBOZ = CMOpM[3] & ~PTE_W;
-    assign InvalidAccess = InvalidRead | InvalidWrite | InvalidCBOM | InvalidCBOZ;
+    assign ReservedEncoding = PTE_W & ~PTE_R; // fault on reserved encoding with R=0, W=1 to match ImperasDV behavior
+    assign InvalidAccess = InvalidRead | InvalidWrite | InvalidCBOM | InvalidCBOZ | ReservedEncoding;
     assign PreUpdateDA = ~PTE_A | WriteAccess & ~PTE_D;
   end
 
diff --git a/tests/coverage/tlbmisc.S b/tests/coverage/tlbmisc.S
index 8d34c1ef1..5475d7e6e 100644
--- a/tests/coverage/tlbmisc.S
+++ b/tests/coverage/tlbmisc.S
@@ -59,7 +59,7 @@ main:
     li t0, 0x80200000
     jalr ra, t0 # jump to misaligned megapage
 
-    # exercise ebufsmarb
+    # exercise ebufsmarb (not yet providing coverage 1/1/24 DH & RT)
     li t0, 0x80000000
     lw t1, 0(t0)        # fetch from an address to warm up tlb entries
     li t0, 0x80A00000
@@ -80,6 +80,20 @@ main:
     sw t1, 0(t0)    # write to page
     jalr ra, t0     # jump to page
 
+    # jump to address for TLB miss to trigger HPTW to make access with DisableTranslation = 1, Translate = 0
+    li t0, 0x80805000
+    jalr ra, t0         
+
+    # Good PBMT with menvcfg.PBMTE = 0
+    li t0, 3
+    ecall   # switch to machine mode
+    li t5, 0x1
+    slli t5, t5, 62
+    csrc menvcfg, t5  # menvcfg.PBMTE = 0
+    li t0, 1
+    ecall   # switch back to supervisor mode
+    li t0, 0x80806000
+    jalr ra, t0      # jump to page to exercise ITLB with PBMT !=0 when ENVCFG_BPMTE=0
 
     # change back to default trap handler after checking everything that might cause an instruction page fault
     jal changetodefaulthandler
@@ -136,7 +150,6 @@ main:
     li a0, 1
     ecall
 
-
     # wrap up
     li a0, 3 # switch back to machine mode because code at 0x80000000 may not have clean page table entry
     ecall
@@ -327,7 +340,8 @@ pagetable:
     .8byte 0x00000000200000CF   # valid rwx for VA 80800000
     .8byte 0x00000000200000CB   # valid r x for VA 80801000
     .8byte 0x00000000200000C3   # valid r   for VA 80802000
-    .8byte 0x00000000200000C5   # valid   x for VA 80803000
+    .8byte 0x00000000200000C9   # valid   x for VA 80803000
     .8byte 0x00000000200000CD   # valid  wx for VA 80804000 (illegal combination, but used to test tlbcontrol)
-
+    .8byte 0x000000002000000F   # valid rwx for VA 80805000  for covering ITLB translate and UpdateDA
+    .8byte 0x20000000200000CF   # PBMT=1    for VA 80806000  for covering ITLB BadPBMT