diff --git a/target/arm/cpu-qom.h b/target/arm/cpu-qom.h
index 0e71569ab5..8f266baa26 100644
--- a/target/arm/cpu-qom.h
+++ b/target/arm/cpu-qom.h
@@ -192,6 +192,9 @@ struct ARMCPUClass {
     OnOffAuto has_vfp;
     /* CPU has Neon */
     OnOffAuto has_neon;
+
+    /* CPU has memory protection unit */
+    bool has_mpu;
 };
 
 static inline int arm_class_feature(ARMCPUClass *acc, int feature)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 8d2f78b601..1b181ecde4 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -889,8 +889,6 @@ struct ArchCPU {
     /* CPU has PMU (Performance Monitor Unit) */
     bool has_pmu;
 
-    /* CPU has memory protection unit */
-    bool has_mpu;
     /* PMSAv7 MPU number of supported regions */
     uint32_t pmsav7_dregion;
     /* v8M SAU number of supported regions */
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index e48f62a6fc..b984735793 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -1279,19 +1279,6 @@ static void arm_cpu_initfn(Object *obj)
 static Property arm_cpu_reset_cbar_property =
             DEFINE_PROP_UINT64("reset-cbar", ARMCPU, reset_cbar, 0);
 
-static Property arm_cpu_has_mpu_property =
-            DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
-
-/* This is like DEFINE_PROP_UINT32 but it doesn't set the default value,
- * because the CPU initfn will have already set cpu->pmsav7_dregion to
- * the right value for that particular CPU type, and we don't want
- * to override that with an incorrect constant value.
- */
-static Property arm_cpu_pmsav7_dregion_property =
-            DEFINE_PROP_UNSIGNED_NODEFAULT("pmsav7-dregion", ARMCPU,
-                                           pmsav7_dregion,
-                                           qdev_prop_uint32, uint32_t);
-
 static bool arm_get_pmu(Object *obj, Error **errp)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -1375,14 +1362,6 @@ static void arm_cpu_post_init(Object *obj)
         object_property_add_bool(obj, "pmu", arm_get_pmu, arm_set_pmu);
     }
 
-    if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
-        qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property);
-        if (arm_feature(&cpu->env, ARM_FEATURE_V7)) {
-            qdev_property_add_static(DEVICE(obj),
-                                     &arm_cpu_pmsav7_dregion_property);
-        }
-    }
-
     if (arm_feature(&cpu->env, ARM_FEATURE_M_SECURITY)) {
         object_property_add_link(obj, "idau", TYPE_IDAU_INTERFACE, &cpu->idau,
                                  qdev_prop_allow_set_link_before_realize,
@@ -1663,39 +1642,21 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
             FIELD_DP64(cpu->isar.id_aa64dfr0, ID_AA64DFR0, PMSVER, 0);
     }
 
-    /* MPU can be configured out of a PMSA CPU either by setting has-mpu
-     * to false or by setting pmsav7-dregion to 0.
-     */
-    if (!cpu->has_mpu) {
-        cpu->pmsav7_dregion = 0;
-    }
-    if (cpu->pmsav7_dregion == 0) {
-        cpu->has_mpu = false;
-    }
-
-    if (arm_feature(env, ARM_FEATURE_PMSA) &&
-        arm_feature(env, ARM_FEATURE_V7)) {
+    if (cpu->pmsav7_dregion) {
         uint32_t nr = cpu->pmsav7_dregion;
 
-        if (nr > 0xff) {
-            error_setg(errp, "PMSAv7 MPU #regions invalid %" PRIu32, nr);
-            return;
-        }
-
-        if (nr) {
-            if (arm_feature(env, ARM_FEATURE_V8)) {
-                /* PMSAv8 */
-                env->pmsav8.rbar[M_REG_NS] = g_new0(uint32_t, nr);
-                env->pmsav8.rlar[M_REG_NS] = g_new0(uint32_t, nr);
-                if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
-                    env->pmsav8.rbar[M_REG_S] = g_new0(uint32_t, nr);
-                    env->pmsav8.rlar[M_REG_S] = g_new0(uint32_t, nr);
-                }
-            } else {
-                env->pmsav7.drbar = g_new0(uint32_t, nr);
-                env->pmsav7.drsr = g_new0(uint32_t, nr);
-                env->pmsav7.dracr = g_new0(uint32_t, nr);
+        if (arm_feature(env, ARM_FEATURE_V8)) {
+            /* PMSAv8 */
+            env->pmsav8.rbar[M_REG_NS] = g_new0(uint32_t, nr);
+            env->pmsav8.rlar[M_REG_NS] = g_new0(uint32_t, nr);
+            if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+                env->pmsav8.rbar[M_REG_S] = g_new0(uint32_t, nr);
+                env->pmsav8.rlar[M_REG_S] = g_new0(uint32_t, nr);
             }
+        } else {
+            env->pmsav7.drbar = g_new0(uint32_t, nr);
+            env->pmsav7.drsr = g_new0(uint32_t, nr);
+            env->pmsav7.dracr = g_new0(uint32_t, nr);
         }
     }
 
@@ -1933,6 +1894,28 @@ static const struct TCGCPUOps arm_tcg_ops = {
 };
 #endif /* CONFIG_TCG */
 
+static bool arm_class_prop_bool_ofs(ObjectClass *oc, Visitor *v,
+                                    const char *name, void *opaque,
+                                    Error **errp)
+{
+    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
+    uintptr_t ofs = (uintptr_t)opaque;
+    bool *ptr = (void *)acc + ofs;
+
+    return visit_type_bool(v, name, ptr, errp);
+}
+
+static bool arm_class_prop_uint32_ofs(ObjectClass *oc, Visitor *v,
+                                      const char *name, void *opaque,
+                                      Error **errp)
+{
+    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
+    uintptr_t ofs = (uintptr_t)opaque;
+    uint32_t *ptr = (void *)acc + ofs;
+
+    return visit_type_uint32(v, name, ptr, errp);
+}
+
 static bool arm_class_prop_uint64_ofs(ObjectClass *oc, Visitor *v,
                                       const char *name, void *opaque,
                                       Error **errp)
@@ -2202,6 +2185,22 @@ static void arm_cpu_leaf_class_init(ObjectClass *oc, void *data)
                            arm_class_prop_set_auto_ofs,
                            (void *)(uintptr_t)offsetof(ARMCPUClass, has_neon));
     }
+
+    if (arm_class_feature(acc, ARM_FEATURE_PMSA)) {
+        acc->has_mpu = true;
+        class_property_add(oc, "has-mpu", "bool", NULL,
+                           arm_class_prop_bool_ofs,
+                           arm_class_prop_bool_ofs,
+                           (void *)(uintptr_t)offsetof(ARMCPUClass, has_mpu));
+
+        if (arm_class_feature(acc, ARM_FEATURE_V7)) {
+            class_property_add(oc, "pmsav7-dregion", "uint32", NULL,
+                               arm_class_prop_uint32_ofs,
+                               arm_class_prop_uint32_ofs,
+                               (void *)(uintptr_t)
+                               offsetof(ARMCPUClass, pmsav7_dregion));
+        }
+    }
 }
 
 static bool arm_cpu_class_late_init(ObjectClass *oc, Error **errp)
@@ -2439,6 +2438,22 @@ static bool arm_cpu_class_late_init(ObjectClass *oc, Error **errp)
         }
     }
 
+    /*
+     * MPU can be configured out of a PMSA CPU either by setting has-mpu
+     * to false or by setting pmsav7-dregion to 0.
+     */
+    if (!acc->has_mpu) {
+        acc->pmsav7_dregion = 0;
+    }
+    if (acc->pmsav7_dregion == 0) {
+        acc->has_mpu = false;
+    }
+    if (acc->pmsav7_dregion > 0xff) {
+        error_setg(errp, "PMSAv7 MPU #regions invalid %" PRIu32,
+                   acc->pmsav7_dregion);
+        return false;
+    }
+
     /* Run some consistency checks for TCG. */
     if (tcg_enabled()) {
         bool no_aa32 = arm_class_feature(acc, ARM_FEATURE_AARCH64) &&
diff --git a/target/arm/helper.c b/target/arm/helper.c
index e414fa11dd..90f49108f8 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -4804,8 +4804,9 @@ static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                         uint64_t value)
 {
     ARMCPU *cpu = env_archcpu(env);
+    ARMCPUClass *acc = ARM_CPU_GET_CLASS(cpu);
 
-    if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) {
+    if (arm_feature(env, ARM_FEATURE_PMSA) && !acc->has_mpu) {
         /* M bit is RAZ/WI for PMSA with no MPU implemented */
         value &= ~SCTLR_M;
     }
