diff --git a/src/main/scala/groundtest/DummyPTW.scala b/src/main/scala/groundtest/DummyPTW.scala
index f9516d1b..05b1532e 100644
--- a/src/main/scala/groundtest/DummyPTW.scala
+++ b/src/main/scala/groundtest/DummyPTW.scala
@@ -30,7 +30,7 @@ class DummyPTW(n: Int)(implicit p: Parameters) extends CoreModule()(p) {
   val s2_chosen = RegEnable(req_arb.io.chosen, req_arb.io.out.valid)
   val s2_valid = Reg(next = req_arb.io.out.valid)
 
-  val s2_resp = Wire(new PTWResp)
+  val s2_resp = Wire(init = 0.U.asTypeOf(new PTWResp))
   s2_resp.pte.ppn := s2_ppn
   s2_resp.pte.reserved_for_software := UInt(0)
   s2_resp.level := UInt(pgLevels-1)
diff --git a/src/main/scala/rocket/CSR.scala b/src/main/scala/rocket/CSR.scala
index 3f0ed479..28ac7831 100644
--- a/src/main/scala/rocket/CSR.scala
+++ b/src/main/scala/rocket/CSR.scala
@@ -497,11 +497,10 @@ class CSRFile(perfEventSets: EventSets = new EventSets(Seq()))(implicit p: Param
   when (exception) {
     val epc = ~(~io.pc | (coreInstBytes-1))
 
-    val write_badaddr = cause isOneOf (Causes.breakpoint,
+    val write_badaddr = cause isOneOf (Causes.illegal_instruction, Causes.breakpoint,
       Causes.misaligned_load, Causes.misaligned_store, Causes.misaligned_fetch,
       Causes.load_access, Causes.store_access, Causes.fetch_access,
-      Causes.load_page_fault, Causes.store_page_fault, Causes.fetch_page_fault
-      )
+      Causes.load_page_fault, Causes.store_page_fault, Causes.fetch_page_fault)
 
     when (trapToDebug) {
       when (!reg_debug) {
diff --git a/src/main/scala/rocket/DCache.scala b/src/main/scala/rocket/DCache.scala
index b8f44c16..a5f4516b 100644
--- a/src/main/scala/rocket/DCache.scala
+++ b/src/main/scala/rocket/DCache.scala
@@ -167,7 +167,7 @@ class DCacheModule(outer: DCache) extends HellaCacheModule(outer) {
   val (s2_hit, s2_grow_param, s2_new_hit_state) = s2_hit_state.onAccess(s2_req.cmd)
   val s2_valid_hit = s2_valid_masked && s2_readwrite && s2_hit
   val s2_valid_miss = s2_valid_masked && s2_readwrite && !s2_hit && !(pstore1_valid || pstore2_valid) && !release_ack_wait
-  val s2_valid_cached_miss = s2_valid_miss && !s2_uncached
+  val s2_valid_cached_miss = s2_valid_miss && !s2_uncached && !uncachedInFlight.asUInt.orR
   val s2_victimize = s2_valid_cached_miss || s2_flush_valid
   val s2_valid_uncached = s2_valid_miss && s2_uncached
   val s2_victim_way = Mux(s2_hit_valid && !s2_flush_valid, s2_hit_way, UIntToOH(RegEnable(s1_victim_way, s1_valid_not_nacked || s1_flush_valid)))
diff --git a/src/main/scala/rocket/Rocket.scala b/src/main/scala/rocket/Rocket.scala
index b3bc820c..22552498 100644
--- a/src/main/scala/rocket/Rocket.scala
+++ b/src/main/scala/rocket/Rocket.scala
@@ -297,9 +297,14 @@ class Rocket(implicit p: Parameters) extends CoreModule()(p)
     when (id_xcpt) { // pass PC down ALU writeback pipeline for badaddr
       ex_ctrl.alu_fn := ALU.FN_ADD
       ex_ctrl.alu_dw := DW_XPR
-      ex_ctrl.sel_alu1 := A1_PC
+      ex_ctrl.sel_alu1 := A1_RS1 // badaddr := instruction
       ex_ctrl.sel_alu2 := A2_ZERO
-      when (!bpu.io.xcpt_if && !ibuf.io.inst(0).bits.pf0 && ibuf.io.inst(0).bits.pf1) { // PC+2
+      when (bpu.io.xcpt_if || id_xcpt_pf || id_xcpt_ae) { // badaddr := PC
+        ex_ctrl.sel_alu1 := A1_PC
+      }
+      val pf_second = !ibuf.io.inst(0).bits.pf0 && ibuf.io.inst(0).bits.pf1
+      val ae_second = !ibuf.io.inst(0).bits.ae0 && ibuf.io.inst(0).bits.ae1
+      when (!bpu.io.xcpt_if && (pf_second || (!id_xcpt_pf && ae_second))) { // badaddr := PC+2
         ex_ctrl.sel_alu2 := A2_SIZE
         ex_reg_rvc := true
       }
@@ -316,10 +321,16 @@ class Rocket(implicit p: Parameters) extends CoreModule()(p)
       ex_reg_rs_bypass(i) := do_bypass
       ex_reg_rs_lsb(i) := bypass_src
       when (id_ren(i) && !do_bypass) {
-        ex_reg_rs_lsb(i) := id_rs(i)(bypass_src.getWidth-1,0)
-        ex_reg_rs_msb(i) := id_rs(i) >> bypass_src.getWidth
+        ex_reg_rs_lsb(i) := id_rs(i)(log2Ceil(bypass_sources.size)-1, 0)
+        ex_reg_rs_msb(i) := id_rs(i) >> log2Ceil(bypass_sources.size)
       }
     }
+    when (id_illegal_insn) {
+      val inst = Mux(ibuf.io.inst(0).bits.rvc, ibuf.io.inst(0).bits.raw(15, 0), ibuf.io.inst(0).bits.raw)
+      ex_reg_rs_bypass(0) := false
+      ex_reg_rs_lsb(0) := inst(log2Ceil(bypass_sources.size)-1, 0)
+      ex_reg_rs_msb(0) := inst >> log2Ceil(bypass_sources.size)
+    }
   }
   when (!ctrl_killd || csr.io.interrupt || ibuf.io.inst(0).bits.replay) {
     ex_reg_cause := id_cause
diff --git a/src/main/scala/rocketchip/Configs.scala b/src/main/scala/rocketchip/Configs.scala
index 5c2a8eee..c5c883ff 100644
--- a/src/main/scala/rocketchip/Configs.scala
+++ b/src/main/scala/rocketchip/Configs.scala
@@ -24,7 +24,8 @@ class BasePlatformConfig extends Config((site, here, up) => {
   // DTS descriptive parameters
   case DTSModel => "ucbbar,rocketchip-unknown"
   case DTSCompat => Nil
-  case DTSTimebase => BigInt(0)
+  case DTSTimebase => BigInt(1000000) // 1 MHz
+  case RTCPeriod => 1000 // Implies coreplex clock is DTSTimebase * RTCPeriod = 1 GHz
   // TileLink connection parameters
   case TLMonitorBuilder => (args: TLMonitorArgs) => Some(LazyModule(new TLMonitor(args)))
   case TLFuzzReadyValid => false
@@ -41,7 +42,6 @@ class BasePlatformConfig extends Config((site, here, up) => {
   case ExtMem => MasterConfig(base=0x80000000L, size=0x10000000L, beatBytes=8, idBits=4)
   case ExtBus => MasterConfig(base=0x60000000L, size=0x20000000L, beatBytes=8, idBits=4)
   case ExtIn  => SlaveConfig(beatBytes=8, idBits=8, sourceBits=2)
-  case RTCPeriod => 100 // gives 10 MHz RTC assuming 1 GHz uncore clock
 })
 
 /** Actual elaboratable target Configs */