diff --git a/src/mmu/pmpadrdec.sv b/src/mmu/pmpadrdec.sv
index fab15b24d..6ba4b85da 100644
--- a/src/mmu/pmpadrdec.sv
+++ b/src/mmu/pmpadrdec.sv
@@ -33,6 +33,7 @@
 
 module pmpadrdec import cvw::*;  #(parameter cvw_t P) (
   input  logic [P.PA_BITS-1:0]  PhysicalAddress,
+  input  logic [1:0]            Size,
   input  logic [7:0]            PMPCfg,
   input  logic [P.PA_BITS-3:0]  PMPAdr,
   input  logic                  FirstMatch,
@@ -52,7 +53,7 @@ module pmpadrdec import cvw::*;  #(parameter cvw_t P) (
   logic                         PAltPMPAdr;
   logic [P.PA_BITS-1:0]         CurrentAdrFull;
   logic [1:0]                   AdrMode;
-  logic [P.PA_BITS-1:0]         PMPTop1;
+  logic [P.PA_BITS-1:0]         PMPTop1, PMPTopTOR, PMPTopNaturallyAligned;
  
   assign AdrMode = PMPCfg[4:3];
 
@@ -83,10 +84,12 @@ module pmpadrdec import cvw::*;  #(parameter cvw_t P) (
                  1'b0;
 
   // Report top of region for first matching region
-  assign PMPTop1 = {PMPAdr,2'b00} | NAMask; // top of the pmp region.  All 1s in the lower bits.  Used to check the address doesn't pass the top
+  // PMP should match but fail if the size is too big (8-byte accesses spanning to TOR or NA4 region)
+  assign PMPTopTOR = {PMPAdr-1,  2'b11}; // TOR goes to (pmpaddr << 2) - 1
+  assign PMPTopNaturallyAligned = {PMPAdr,2'b00} | NAMask; // top of the pmp region for NA4 and NAPOT.  All 1s in the lower bits.  Used to check the address doesn't pass the top
+  assign PMPTop1 = (AdrMode == TOR) ? PMPTopTOR : PMPTopNaturallyAligned;
   assign PMPTop = FirstMatch ? PMPTop1 : '0; // AND portion of distributed AND-OR mux (OR portion in pmpchhecker)
 
-  // PMP should match but fail if the size is too big (8-byte accesses spanning to TOR or NA4 region)
   assign L = PMPCfg[7];
   assign X = PMPCfg[2];
   assign W = PMPCfg[1];
diff --git a/src/mmu/pmpchecker.sv b/src/mmu/pmpchecker.sv
index 27f8745fe..889ff9372 100644
--- a/src/mmu/pmpchecker.sv
+++ b/src/mmu/pmpchecker.sv
@@ -66,6 +66,7 @@ module pmpchecker import cvw::*;  #(parameter cvw_t P) (
   if (P.PMP_ENTRIES > 0) begin: pmp // prevent complaints about array of no elements when PMP_ENTRIES = 0
     pmpadrdec #(P) pmpadrdecs[P.PMP_ENTRIES-1:0](
       .PhysicalAddress, 
+      .Size,
       .PMPCfg(PMPCFG_ARRAY_REGW),
       .PMPAdr(PMPADDR_ARRAY_REGW),
       .FirstMatch,
diff --git a/testbench/tests.vh b/testbench/tests.vh
index 26dd7c2fb..035920b21 100644
--- a/testbench/tests.vh
+++ b/testbench/tests.vh
@@ -194,7 +194,6 @@ string arch32pmp[] = '{
   "rv32i_m/pmp32/src/pmp-TOR-X.S"
 };
 
-// Tests commented out pending riscv-arch-test issue #588
 string arch64pmp[] = '{
   `RISCVARCHTEST,
   "rv64i_m/pmp/src/pmp64-CSR-ALL-MODES.S",
@@ -203,10 +202,10 @@ string arch64pmp[] = '{
   "rv64i_m/pmp/src/pmp64-NA4-U.S",
   "rv64i_m/pmp/src/pmp64-NAPOT-M.S",
   "rv64i_m/pmp/src/pmp64-NAPOT-S.S",
-  "rv64i_m/pmp/src/pmp64-NAPOT-U.S"
-  // "rv64i_m/pmp/src/pmp64-TOR-M.S", TODO: Reenable when Wally top of PMP region bug is fixed
-  // "rv64i_m/pmp/src/pmp64-TOR-S.S",
-  // "rv64i_m/pmp/src/pmp64-TOR-U.S"
+  "rv64i_m/pmp/src/pmp64-NAPOT-U.S",
+  "rv64i_m/pmp/src/pmp64-TOR-M.S",
+  "rv64i_m/pmp/src/pmp64-TOR-S.S",
+  "rv64i_m/pmp/src/pmp64-TOR-U.S"
 };
 
 string arch32vm_sv32[] = '{