diff --git a/qemu/target/arm/m_helper.c b/qemu/target/arm/m_helper.c
index e14ec300..c1974ca9 100644
--- a/qemu/target/arm/m_helper.c
+++ b/qemu/target/arm/m_helper.c
@@ -2667,7 +2667,8 @@ ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
 /* Return the MMU index for a v7M CPU in the specified security state */
 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
 {
-    bool priv = arm_current_el(env) != 0;
+    bool priv = arm_v7m_is_handler_mode(env) ||
+        !(env->v7m.control[secstate] & 1);
 
     return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv);
 }