QEMU virtio-pci-pmem memory addresses over 4G

Question

I want a persistent memory in a qemu 32bits machine that I can access directly from my code. My idea is to place a virtio-pci-pmem memory just after the RAM (at 0x400000) and reload the persistent memory file at the same address at each reboot.

I tried to access a virtio-pci-pmem memory from the code but the address spaces go beyond 32 bits addresses so I can't access it.

The code running is a zephyr-RTOS project compiled for the qemu_x86 board.

I test with the following code :

void main(void)
{
    uint8_t* test = 0x400000;
    printk("Test Addr : %x\n", test);
    *test+=1;
    printk("Test value : %d\n", *test);
    k_sleep(K_SECONDS(20));
}

I use the following command to start qemu with monitor : /usr/bin/qemu-system-i386 -machine pc -m 4M,slots=2,maxmem=16M -cpu qemu32 -device isa-debug-exit,iobase=0xf4,iosize=0x04 -nographic -net none -pidfile qemu.pid -serial unix:/tmp/bt-server-bredr -monitor stdio -object memory-backend-file,id=mem1,share=off,mem-path=flash.img,size=1M,pmem=on -device virtio-pmem-pci,memdev=mem1,id=nv1 -device loader,file=flash.img,addr=0x400000,cpu-num=0,force-raw=on -s -kernel zephyr.elf

I have the following memory tree :

memory-region: system
  0000000000000000-ffffffffffffffff (prio 0, i/o): system
    0000000000000000-00000000003fffff (prio 0, i/o): alias ram-below-4g @pc.ram 0000000000000000-00000000003fffff
    0000000000000000-ffffffffffffffff (prio -1, i/o): pci
      00000000000a0000-00000000000bffff (prio 1, i/o): vga-lowmem
      00000000000c0000-00000000000dffff (prio 1, rom): pc.rom
      00000000000e0000-00000000000fffff (prio 1, i/o): alias isa-bios @pc.bios 0000000000020000-000000000003ffff
      00000000fffc0000-00000000ffffffff (prio 0, rom): pc.bios
    00000000000a0000-00000000000bffff (prio 1, i/o): alias smram-region @pci 00000000000a0000-00000000000bffff
    00000000000c0000-00000000000c3fff (prio 1, i/o): alias pam-ram @pc.ram 00000000000c0000-00000000000c3fff [disabled]
[...]
    00000000000f0000-00000000000fffff (prio 1, i/o): alias pam-pci @pc.ram 00000000000f0000-00000000000fffff [disabled]
    00000000000f0000-00000000000fffff (prio 1, i/o): alias pam-rom @pc.ram 00000000000f0000-00000000000fffff [disabled]
    00000000000f0000-00000000000fffff (prio 1, i/o): alias pam-pci @pci 00000000000f0000-00000000000fffff
    00000000fec00000-00000000fec00fff (prio 0, i/o): ioapic
    00000000fed00000-00000000fed003ff (prio 0, i/o): hpet
    00000000fee00000-00000000feefffff (prio 4096, i/o): apic-msi
    **0000000100000000-0000000180bfffff (prio 0, i/o): device-memory
      0000000100000000-00000001000fffff (prio 0, ram): mem1**

Here are my questions :

Why is mem1 placed over 4G ? Is it possible to force the address to be below 2^32 ? How can I access it from 32bits code ?

I also tried to disable the PAE cpu flag by adding pae=off but it change nothing.