diff --git a/qemu/include/exec/memattrs.h b/qemu/include/exec/memattrs.h
index 68a9c760..1389b4b0 100644
--- a/qemu/include/exec/memattrs.h
+++ b/qemu/include/exec/memattrs.h
@@ -31,6 +31,8 @@ typedef struct MemTxAttrs {
     unsigned int unspecified:1;
     /* ARM/AMBA TrustZone Secure access */
     unsigned int secure:1;
+    /* Memory access is usermode (unprivileged) */
+    unsigned int user:1;
 } MemTxAttrs;
 
 /* Bus masters which don't specify any attributes will get this,
diff --git a/qemu/target-arm/helper.c b/qemu/target-arm/helper.c
index 441d417a..a3970f90 100644
--- a/qemu/target-arm/helper.c
+++ b/qemu/target-arm/helper.c
@@ -5233,6 +5233,7 @@ static inline int get_phys_addr(CPUARMState *env, target_ulong address,
      * to secure.
      */
     attrs->secure = regime_is_secure(env, mmu_idx);
+    attrs->user = regime_is_user(env, mmu_idx);
 
     /* Fast Context Switch Extension. This doesn't exist at all in v8.
      * In v7 and earlier it affects all stage 1 translations.