diff --git a/src/main/scala/vexriscv/plugin/MmuPlugin.scala b/src/main/scala/vexriscv/plugin/MmuPlugin.scala
index 73efaf0..423b1ce 100644
--- a/src/main/scala/vexriscv/plugin/MmuPlugin.scala
+++ b/src/main/scala/vexriscv/plugin/MmuPlugin.scala
@@ -97,13 +97,14 @@ class MmuPlugin(ioRange : UInt => Bool,
         new Area {
           val mode = out(RegInit(False))
           val asid = out(Reg(Bits(9 bits)))
-          val ppn = out(Reg(UInt(20 bits)))
+          // Bottom 20 bits are used in implementation, but top 2 bits are still stored for OS use.
+          val ppn = out(Reg(UInt(22 bits)))
         }
       } else {
         new Area {
           val mode = RegInit(False)
           val asid = Reg(Bits(9 bits))
-          val ppn = Reg(UInt(20 bits))
+          val ppn = Reg(UInt(22 bits))
         }
       }
 
@@ -243,7 +244,8 @@ class MmuPlugin(ioRange : UInt => Bool,
           }
           is(State.L1_CMD){
             dBusAccess.cmd.valid := True
-            dBusAccess.cmd.address := csr.satp.ppn @@ vpn(1) @@ U"00"
+            // RV spec allows for 34-bit phys address in Sv32 mode; we only implement 32 bits and ignore the top 2 bits of satp.
+            dBusAccess.cmd.address := csr.satp.ppn(19 downto 0) @@ vpn(1) @@ U"00"
             when(dBusAccess.cmd.ready){
               state := State.L1_RSP
             }