diff --git a/qemu/target-arm/cpu.c b/qemu/target-arm/cpu.c
index 32f18828..21996742 100644
--- a/qemu/target-arm/cpu.c
+++ b/qemu/target-arm/cpu.c
@@ -348,6 +348,11 @@ static int arm_cpu_realizefn(struct uc_struct *uc, DeviceState *dev, Error **err
         } else {
             set_feature(env, ARM_FEATURE_V6);
         }
+
+        /* Always define VBAR for V7 CPUs even if it doesn't exist in
+         * non-EL3 configs. This is needed by some legacy boards.
+         */
+        set_feature(env, ARM_FEATURE_VBAR);
     }
     if (arm_feature(env, ARM_FEATURE_V6K)) {
         set_feature(env, ARM_FEATURE_V6);
@@ -391,6 +396,10 @@ static int arm_cpu_realizefn(struct uc_struct *uc, DeviceState *dev, Error **err
             cpu->reset_sctlr |= (1 << 13);
     }
 
+    if (arm_feature(env, ARM_FEATURE_EL3)) {
+        set_feature(env, ARM_FEATURE_VBAR);
+    }
+
     register_cp_regs_for_features(cpu);
     arm_cpu_register_gdb_regs_for_features(cpu);
 
diff --git a/qemu/target-arm/cpu.h b/qemu/target-arm/cpu.h
index c425da5f..c17c011c 100644
--- a/qemu/target-arm/cpu.h
+++ b/qemu/target-arm/cpu.h
@@ -750,6 +750,7 @@ enum arm_features {
     ARM_FEATURE_V8_SHA256, /* implements SHA256 part of v8 Crypto Extensions */
     ARM_FEATURE_V8_PMULL, /* implements PMULL part of v8 Crypto Extensions */
     ARM_FEATURE_THUMB_DSP, /* DSP insns supported in the Thumb encodings */
+    ARM_FEATURE_VBAR, /* has cp15 VBAR */
     ARM_FEATURE_V8_SHA3, /* implements SHA3 part of v8 Crypto Extensions */
 };
 
diff --git a/qemu/target-arm/helper.c b/qemu/target-arm/helper.c
index 93521029..0c6ba525 100644
--- a/qemu/target-arm/helper.c
+++ b/qemu/target-arm/helper.c
@@ -751,9 +751,6 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
     { "PMINTENCLR", 15,9,14, 0,0,2, 0,
       ARM_CP_NO_MIGRATE, PL1_RW, NULL, 0, offsetof(CPUARMState, cp15.c9_pminten),
       NULL, NULL, pmintenclr_write, },
-    { "VBAR", 0,12,0, 3,0,0, ARM_CP_STATE_BOTH,
-      0, PL1_RW, NULL, 0, offsetof(CPUARMState, cp15.vbar_el[1]),
-      NULL, NULL, vbar_write, },
     { "SCR", 15,1,1, 0,0,0, 0,
       0, PL1_RW, NULL, 0, offsetoflow32(CPUARMState, cp15.scr_el3),
       NULL, NULL, scr_write },
@@ -2708,6 +2705,16 @@ void register_cp_regs_for_features(ARMCPU *cpu)
         }
     }
 
+    if (arm_feature(env, ARM_FEATURE_VBAR)) {
+        ARMCPRegInfo vbar_cp_reginfo[] = {
+            { "VBAR", 0,12,0, 3,0,0, ARM_CP_STATE_BOTH,
+              0, PL1_RW, NULL, 0, offsetof(CPUARMState, cp15.vbar_el[1]),
+              NULL, NULL, vbar_write, },
+            REGINFO_SENTINEL
+        };
+        define_arm_cp_regs(cpu, vbar_cp_reginfo);
+    }
+
     /* Generic registers whose values depend on the implementation */
     {
         ARMCPRegInfo sctlr = {