Index: generic/include/mm/as.h
===================================================================
--- generic/include/mm/as.h	(revision baafe7129927f6fcfc81c0942b4cae0a700500cb)
+++ generic/include/mm/as.h	(revision fd4d8c080e51030459c861e84ddbc47663832efa)
@@ -149,5 +149,6 @@
 extern void as_switch(as_t *old, as_t *new);
 extern void as_free(as_t *as);
-extern int as_area_share(as_t *src_as, __address src_base, size_t acc_size, __address dst_base);
+extern int as_area_share(as_t *src_as, __address src_base, size_t acc_size,
+	__address dst_base, int dst_flags_mask);
 extern size_t as_get_size(__address base);
 extern int used_space_insert(as_area_t *a, __address page, count_t count);
Index: generic/src/ipc/sysipc.c
===================================================================
--- generic/src/ipc/sysipc.c	(revision baafe7129927f6fcfc81c0942b4cae0a700500cb)
+++ generic/src/ipc/sysipc.c	(revision fd4d8c080e51030459c861e84ddbc47663832efa)
@@ -139,6 +139,6 @@
 			interrupts_restore(ipl);
 			
-			return as_area_share(as, IPC_GET_ARG2(*olddata),IPC_GET_ARG3(*olddata),
-				IPC_GET_ARG1(answer->data));
+			return as_area_share(as, IPC_GET_ARG1(*olddata), IPC_GET_ARG2(*olddata),
+				IPC_GET_ARG1(answer->data), IPC_GET_ARG3(*olddata));
 		}
 	}
@@ -166,9 +166,9 @@
 		break;
 	case IPC_M_AS_AREA_SEND:
-		size = as_get_size(IPC_GET_ARG2(call->data));
+		size = as_get_size(IPC_GET_ARG1(call->data));
 		if (!size) {
 			return EPERM;
 		}
-		IPC_SET_ARG3(call->data, size);
+		IPC_SET_ARG2(call->data, size);
 		break;
 	default:
Index: generic/src/mm/as.c
===================================================================
--- generic/src/mm/as.c	(revision baafe7129927f6fcfc81c0942b4cae0a700500cb)
+++ generic/src/mm/as.c	(revision fd4d8c080e51030459c861e84ddbc47663832efa)
@@ -459,8 +459,9 @@
  * sh_info of the source area.
  * 
- * @param src_as Pointer to source address space
+ * @param src_as Pointer to source address space.
  * @param src_base Base address of the source address space area.
- * @param acc_size Expected size of the source area
- * @param dst_base Target base address
+ * @param acc_size Expected size of the source area.
+ * @param dst_base Target base address.
+ * @param dst_flags_mask Destination address space area flags mask.
  *
  * @return Zero on success or ENOENT if there is no such task or
@@ -472,5 +473,5 @@
  */
 int as_area_share(as_t *src_as, __address src_base, size_t acc_size,
-		  __address dst_base)
+		  __address dst_base, int dst_flags_mask)
 {
 	ipl_t ipl;
@@ -568,6 +569,9 @@
 	 * attribute set which prevents race condition with
 	 * preliminary as_page_fault() calls.
-	 */
-	dst_area = as_area_create(AS, src_flags, src_size, dst_base, AS_AREA_ATTR_PARTIAL, &anon_backend, NULL);
+	 * The flags of the source area are masked against dst_flags_mask
+	 * to support sharing in less privileged mode.
+	 */
+	dst_area = as_area_create(AS, src_flags & dst_flags_mask, src_size, dst_base,
+				  AS_AREA_ATTR_PARTIAL, &anon_backend, NULL);
 	if (!dst_area) {
 		/*