PCBB.PTBR contains a page frame number, not a physical address.
diff --git a/init.c b/init.c
index 25ca743..cb900c5 100644
--- a/init.c
+++ b/init.c
@@ -209,7 +209,7 @@
 init_pcb (void)
 {
   pcb.ksp = (unsigned long)stack + sizeof(stack);
-  pcb.ptbr = PA(page_dir);
+  pcb.ptbr = PA(page_dir) >> PAGE_SHIFT;
   pcb.flags = 1; /* FEN */
 }
 
diff --git a/pal.S b/pal.S
index 913b8f8..bea194f 100644
--- a/pal.S
+++ b/pal.S
@@ -565,12 +565,15 @@
 	ldq_p	t4, PCB_Q_FEN(a2)
 
 	mtpr	t0, ptUsp
+
+	sll	t1, VA_S_OFF, t1
 	mtpr	t1, qemu_ptbr
-	mtpr	t3, qemu_unique
 
 	subl	t2, p0, t2
 	mtpr	t2, qemu_pcc_ofs
 
+	mtpr	t3, qemu_unique
+
 	and	t4, 1, t4
 	mtpr	t4, qemu_fen
 
@@ -908,6 +911,7 @@
 	// QEMU does not implement an ASN; skip that.
 
 	ldq_p	t10, PCB_Q_PTBR(a0)	// Install new page tables
+	sll	t10, VA_S_OFF, t10
 	mtpr	t10, qemu_ptbr
 	mtpr	$31, qemu_tbia		// Flush TLB, since we don't do ASNs