--- qemu.orig/linux-user/mmap.c
+++ qemu/linux-user/mmap.c
@@ -29,6 +29,10 @@
 
 //#define DEBUG_MMAP
 
+#ifndef MAP_32BIT
+#define MAP_32BIT 0
+#endif
+
 /* NOTE: all the constants are the HOST ones, but addresses are target. */
 int target_mprotect(target_ulong start, target_ulong len, int prot)
 {
@@ -234,7 +238,7 @@
             host_offset = offset & qemu_host_page_mask;
             host_len = len + offset - host_offset;
             host_start = (long)mmap(real_start ? g2h(real_start) : NULL,
-                                    host_len, prot, flags, fd, host_offset);
+                                    host_len, prot, (flags | MAP_32BIT), fd, host_offset);
             if (host_start == -1)
                 return host_start;
             /* update start so that it points to the file position at 'offset' */
@@ -388,7 +392,7 @@
     int prot;
 
     /* XXX: use 5 args syscall */
-    new_addr = (long)mremap(g2h(old_addr), old_size, new_size, flags);
+    new_addr = (long)mremap(g2h(old_addr), old_size, new_size, (flags | MAP_32BIT));
     if (new_addr == -1)
         return new_addr;
     new_addr = h2g(new_addr);