diff --git a/src/main/scala/vexriscv/plugin/MmuPlugin.scala b/src/main/scala/vexriscv/plugin/MmuPlugin.scala
index c984b03..c17a387 100644
--- a/src/main/scala/vexriscv/plugin/MmuPlugin.scala
+++ b/src/main/scala/vexriscv/plugin/MmuPlugin.scala
@@ -94,7 +94,8 @@ class MmuPlugin(ioRange : UInt => Bool,
       val satp = new Area {
         val mode = RegInit(False)
         val asid = Reg(Bits(9 bits))
-        val ppn = Reg(UInt(20 bits))
+        // Bottom 20 bits are used in implementation, but top 2 bits are still stored for OS use.
+        val ppn = Reg(UInt(22 bits))
       }
 
       for(offset <- List(CSR.MSTATUS, CSR.SSTATUS)) csrService.rw(offset, 19 -> status.mxr, 18 -> status.sum, 17 -> status.mprv)
@@ -233,7 +234,8 @@ class MmuPlugin(ioRange : UInt => Bool,
           }
           is(State.L1_CMD){
             dBusAccess.cmd.valid := True
-            dBusAccess.cmd.address := csr.satp.ppn @@ vpn(1) @@ U"00"
+            // RV spec allows for 34-bit phys address in Sv32 mode; we only implement 32 bits and ignore the top 2 bits of satp.
+            dBusAccess.cmd.address := csr.satp.ppn(19 downto 0) @@ vpn(1) @@ U"00"
             when(dBusAccess.cmd.ready){
               state := State.L1_RSP
             }