Index: qemu/linux-user/mmap.c
===================================================================
--- qemu.orig/linux-user/mmap.c
+++ qemu/linux-user/mmap.c
@@ -27,6 +27,10 @@
 
 #include "qemu.h"
 
+#if !defined(MAP_32BIT)
+#define MAP_32BIT 0
+#endif
+
 //#define DEBUG_MMAP
 
 /* NOTE: all the constants are the HOST ones, but addresses are target. */
@@ -118,7 +122,7 @@ static int mmap_frag(target_ulong real_s
     if (prot1 == 0) {
         /* no page was there, so we allocate one */
         ret = (long)mmap(host_start, qemu_host_page_size, prot, 
-                         flags | MAP_ANONYMOUS, -1, 0);
+                         flags | MAP_ANONYMOUS | MAP_32BIT, -1, 0);
         if (ret == -1)
             return ret;
         prot1 = prot;
@@ -219,7 +223,8 @@ long target_mmap(target_ulong start, tar
 abort();
             host_len = HOST_PAGE_ALIGN(len) + qemu_host_page_size - TARGET_PAGE_SIZE;
             real_start = (long)mmap(g2h(real_start), host_len, PROT_NONE, 
-                                    MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+                                    MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT
+									, -1, 0);
             if (real_start == -1)
                 return real_start;
             real_end = real_start + host_len;
@@ -236,7 +241,7 @@ abort();
             host_offset = offset & qemu_host_page_mask;
             host_len = len + offset - host_offset;
             host_start = (long)mmap(real_start ? g2h(real_start) : NULL,
-                                    host_len, prot, flags, fd, host_offset);
+                                    host_len, prot, flags | MAP_32BIT, fd, host_offset);
             if (host_start == -1)
                 return host_start;
             /* update start so that it points to the file position at 'offset' */
@@ -314,7 +319,7 @@ abort();
 	else
 	  offset1 = offset + real_start - start;
         ret = (long)mmap(g2h(real_start), real_end - real_start, 
-                         prot, flags, fd, offset1);
+                         prot, flags | MAP_32BIT, fd, offset1);
         if (ret == -1)
             return ret;
     }
@@ -390,7 +395,7 @@ long target_mremap(target_ulong old_addr
     int prot;
 
     /* XXX: use 5 args syscall */
-    new_addr = (long)mremap(g2h(old_addr), old_size, new_size, flags);
+    new_addr = (long)mremap(g2h(old_addr), old_size, new_size, flags | MAP_32BIT);
     if (new_addr == -1)
         return new_addr;
     new_addr = h2g(new_addr);